CVE-2004-2509 EXPLOIT
4.3
MEDIUM · CVSS 2.0 · EPSS 2.2% (pctl 82)
Patch early
A public exploit exists.
Description
Cross-site scripting (XSS) vulnerabilities in (1) calendar.php, (2) login.php, and (3) online.php in Infopop UBB.Threads 6.2.3 and 6.5 allow remote attackers to inject arbitrary web script or HTML via the Cat parameter.
Scoring
| CVSS | 4.3 (MEDIUM, v2.0) |
|---|---|
| Vector | AV:N/AC:M/Au:N/C:N/I:P/A:N |
| EPSS | 2.23% — more likely to be exploited than 82% of all CVEs |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2004-12-31 |
| Last modified | 2026-06-16 |
Affected (1)
| Vendor | Product |
|---|---|
| ubbcentral | ubb.threads |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | UBBCentral UBB.Threads 6.2.3/6.5 - 'calendar.php?Cat' Cross-Site Scripting | 2004-12-13 |
| exploit-db | UBBCentral UBB.Threads 6.2.3/6.5 - 'login.php?Cat' Cross-Site Scripting | 2004-12-13 |
| exploit-db | UBBCentral UBB.Threads 6.2.3/6.5 - 'online.php?Cat' Cross-Site Scripting | 2004-12-13 |
References
- http://archives.neohapsis.com/archives/fulldisclosure/2004-12/0239.html
- http://secunia.com/advisories/13452
- http://securitytracker.com/id?1012503
- http://www.osvdb.org/12365
- http://www.osvdb.org/12366
- http://www.osvdb.org/12367
- http://www.securityfocus.com/bid/11900
- https://exchange.xforce.ibmcloud.com/vulnerabilities/18432
- http://archives.neohapsis.com/archives/fulldisclosure/2004-12/0239.html
- http://secunia.com/advisories/13452
- http://securitytracker.com/id?1012503
- http://www.osvdb.org/12365
- http://www.osvdb.org/12366
- http://www.osvdb.org/12367
- http://www.securityfocus.com/bid/11900
- https://exchange.xforce.ibmcloud.com/vulnerabilities/18432
→ the Explorer · watch your stack · NVD