$ cve CVE-2004-1043 JSON

CVE-2004-1043 EXPLOIT

5.0

MEDIUM · CVSS 2.0 · EPSS 45% (pctl 99)

Patch early

A public exploit exists.

Description

Internet Explorer 6.0 on Windows XP SP2 allows remote attackers to execute arbitrary code by using the "Related Topics" command in the Help ActiveX Control (hhctrl.ocx) to open a Help popup window containing the PCHealth tools.htm file in the local zone and injecting Javascript to be executed, as demonstrated using "writehta.txt" and the ADODB recordset, which saves a .HTA file to the local system, aka the "HTML Help ActiveX control Cross Domain Vulnerability."

Scoring

CVSS	5.0 (MEDIUM, v2.0)
Vector	AV:N/AC:L/Au:N/C:N/I:P/A:N
EPSS	44.98% — more likely to be exploited than 99% of all CVEs
On CISA KEV	no
Public exploit	yes
Published	2004-12-31
Last modified	2026-06-16

Affected (2)

Vendor	Product
microsoft	internet explorer
microsoft	windows xp

Public exploits

Source	Title	Date
exploit-db	Microsoft Internet Explorer (Windows XP SP2) - HTML Help Control Local Zone Bypass	2004-12-25

References

→ the Explorer · watch your stack · NVD