CVE-2004-2115 EXPLOIT
6.8
MEDIUM · CVSS 2.0 · EPSS 58.4% (pctl 99)
Patch early
A public exploit exists.
Description
Multiple cross-site scripting (XSS) vulnerabilities in Oracle HTTP Server 1.3.22, based on Apache, allow remote attackers to execute arbitrary script as other users via the (1) action, (2) username, or (3) password parameters in an isqlplus request.
Scoring
| CVSS | 6.8 (MEDIUM, v2.0) |
|---|---|
| Vector | AV:N/AC:M/Au:N/C:P/I:P/A:P |
| EPSS | 58.35% — more likely to be exploited than 99% of all CVEs |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2004-12-31 |
| Last modified | 2026-06-16 |
Affected (1)
| Vendor | Product |
|---|---|
| oracle | http server |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Oracle HTTP Server 8.1.7/9.0.1/9.2 - isqlplus Cross-Site Scripting | 2004-01-24 |
References
→ the Explorer · watch your stack · NVD