$ cve CVE-2005-1030 JSON

CVE-2005-1030 EXPLOIT

4.3

MEDIUM · CVSS 2.0 · EPSS 5.1% (pctl 92)

Patch early

A public exploit exists.

Description

Multiple cross-site scripting (XSS) vulnerabilities in Active Auction House allow remote attackers to inject arbitrary web script or HTML via the (1) ReturnURL, (2) password, (3) username parameter, (4) ReturnURL parameter to account.asp, (5) Table, (6) Title parameter to sendpassword.asp, or (7) itemid to watchthisitem.asp.

Scoring

CVSS	4.3 (MEDIUM, v2.0)
Vector	AV:N/AC:M/Au:N/C:N/I:P/A:N
EPSS	5.09% — more likely to be exploited than 92% of all CVEs
On CISA KEV	no
Public exploit	yes
Published	2005-05-02
Last modified	2026-06-16

Affected (1)

Vendor	Product
active web softwares	active auction house

Public exploits

Source	Title	Date
exploit-db	Active Auction House - 'start.asp?ReturnURL' Cross-Site Scripting	2005-04-06
exploit-db	Active Auction House - 'account.asp?ReturnURL' Cross-Site Scripting	2005-04-06
exploit-db	Active Auction House - 'sendpassword.asp' Multiple Cross-Site Scripting Vulnerabilities	2005-04-06
exploit-db	Active Auction House - 'WatchThisItem.asp' Cross-Site Scripting	2005-04-06

References

→ the Explorer · watch your stack · NVD