peter bassill · operator
$ cve CVE-2004-2059 JSON

CVE-2004-2059 EXPLOIT

5.0
MEDIUM · CVSS 2.0 · EPSS 8.8% (pctl 95)

Patch early

A public exploit exists.

Description

Multiple cross-site scripting vulnerabilities in ASPRunner 2.4 allow remote attackers to inject arbitrary web script or HTML via the (1) SearchFor parameter in [TABLE-NAME]_search.asp, (2) SQL parameter in [TABLE-NAME]_edit.asp, (3) SearchFor parameter in [TABLE]_list.asp, or (4) SQL parameter in export.asp.

Scoring

CVSS5.0 (MEDIUM, v2.0)
VectorAV:N/AC:L/Au:N/C:N/I:P/A:N
EPSS8.82% — more likely to be exploited than 95% of all CVEs
On CISA KEVno
Public exploityes
Published2004-12-31
Last modified2026-06-16

Affected (1)

VendorProduct
xlinesoftasprunner

Public exploits

SourceTitleDate
exploit-dbXLineSoft ASPRunner 1.0/2.x - '[TABLE-NAME]_search.asp?Typeen' Cross-Site Scripting2004-07-26
exploit-dbXLineSoft ASPRunner 1.0/2.x - '[TABLE-NAME]_edit.asp?SQL' Cross-Site Scripting2004-07-26
exploit-dbXLineSoft ASPRunner 1.0/2.x - '[TABLE]_list.asp?searchFor' Cross-Site Scripting2004-07-26
exploit-dbXLineSoft ASPRunner 1.0/2.x - 'export.asp?SQL' Cross-Site Scripting2004-07-26

References

→ the Explorer  ·  watch your stack  ·  NVD