$ cve CVE-2004-1719 JSON

CVE-2004-1719 EXPLOIT

4.3

MEDIUM · CVSS 2.0 · EPSS 5% (pctl 92)

Patch early

A public exploit exists.

Description

Multiple cross-site scripting (XSS) vulnerabilities in Merak Webmail Server 5.2.7 allow remote attackers to inject arbitrary web script or HTML via the (1) category, (2) cserver, (3) ext, (4) global, (5) showgroups, (6) or showlite parameters to address.html, or the (7) spage or (8) autoresponder parameters to settings.html, the (9) folder parameter to readmail.html, or the (10) attachmentpage_text_error parameter to attachment.html, (11) folder, (12) ct, or (13) cv parameters to calendar.html, (14) an <img> tag, or (15) the subject of an e-mail message.

Scoring

CVSS	4.3 (MEDIUM, v2.0)
Vector	AV:N/AC:M/Au:N/C:N/I:P/A:N
EPSS	5.01% — more likely to be exploited than 92% of all CVEs
On CISA KEV	no
Public exploit	yes
Published	2004-08-17
Last modified	2026-06-16

Affected (1)

Vendor	Product
merak	mail server

Public exploits

Source	Title	Date
exploit-db	Merak Mail Server 7.4.5 - 'address.html' Multiple Cross-Site Scripting Vulnerabilities	2004-07-17
exploit-db	Merak Mail Server 7.4.5 - 'settings.html' Multiple Cross-Site Scripting Vulnerabilities	2004-07-17
exploit-db	Merak Mail Server 7.4.5 - 'attachment.html?attachmentpage_text_error' Cross-Site Scripting	2004-07-17
exploit-db	Merak Mail Server 7.4.5 - HTML Message Body Cross-Site Scripting	2004-07-17

References

→ the Explorer · watch your stack · NVD