vulnwire
4.3med

CVE-2004-006714 exploits

Multiple cross-site scripting (XSS) vulnerabilities in phpGedView before 2.65 allow remote attackers to inject arbitrary HTML or web script…

Published 22 y ago · modified 4 mo ago · JSON

CVSS
4.3
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
3.1%
percentile 88%
Public exploits
14
Exploit-DB

Multiple cross-site scripting (XSS) vulnerabilities in phpGedView before 2.65 allow remote attackers to inject arbitrary HTML or web script via (1) descendancy.php, (2) index.php, (3) individual.php, (4) login.php, (5) relationship.php, (6) source.php, (7) imageview.php, (8) calendar.php, (9) gedrecord.php, (10) login.php, and (11) gdbi_interface.php. NOTE: some aspects of vector 10 were later reported to affect 4.1.

Exploit prediction (EPSS)

3.15% probability of exploitation in the next 30 days, higher than 88% of all scored CVEs.

Exploits and detections

  • EDB-24837 PHPGedView 2.5/2.6 - 'Timeline.php' SQL Injection · webapps · 2004-01-12
  • EDB-24835 PHPGedView 2.5/2.6 - 'Placelist.php' SQL Injection · webapps · 2004-01-12
  • EDB-24834 PHPGedView 2.5/2.6 - 'calendar.php' Cross-Site Scripting · webapps · 2004-01-12
  • EDB-24832 PHPGedView 2.5/2.6 - 'Relationship.php' Cross-Site Scripting · webapps · 2004-01-12
  • EDB-24831 PHPGedView 2.5/2.6 - 'login.php' Newlanguage Cross-Site Scripting · webapps · 2004-01-12
  • EDB-24830 PHPGedView 2.5/2.6 - 'login.php?Username' Cross-Site Scripting · webapps · 2004-01-12
  • EDB-24829 PHPGedView 2.5/2.6 - 'login.php?URL' Cross-Site Scripting · webapps · 2004-01-12
  • EDB-24822 PHPGedView 2.5/2.6 - 'Gdbi_interface.php' Cross-Site Scripting · webapps · 2004-01-12
  • EDB-24821 PHPGedView 2.5/2.6 - 'Gedrecord.php' Cross-Site Scripting · webapps · 2004-01-12
  • EDB-24820 PHPGedView 2.5/2.6 - 'Imageview.php' Cross-Site Scripting · webapps · 2004-01-12
  • EDB-24819 PHPGedView 2.5/2.6 - 'Source.php' Cross-Site Scripting · webapps · 2004-01-12
  • EDB-24816 PHPGedView 2.5/2.6 - 'Individual.php' Cross-Site Scripting · webapps · 2004-01-12
  • EDB-24814 PHPGedView 2.5/2.6 - 'index.php' Cross-Site Scripting · webapps · 2004-01-12
  • EDB-24810 PHPGedView 2.x - 'Descendancy.php' Cross-Site Scripting · webapps · 2004-01-19

CVSS scores

Assigned byVersionScoreVector
NVD2.04.3AV:N/AC:M/Au:N/C:N/I:P/A:N

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

  • securityfocus.com /bid/11891 · vdb-entry, x_refsource_BID, x_transferred
  • osvdb.org /3473 · vdb-entry, x_refsource_OSVDB, x_transferred
  • secunia.com /advisories/26628 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • osvdb.org /3478 · vdb-entry, x_refsource_OSVDB, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/14212 · vdb-entry, x_refsource_XF, x_transferred
  • securityfocus.com /bid/11904 · vdb-entry, x_refsource_BID, x_transferred
  • vupen.com /english/advisories/2007/2995 · vdb-entry, x_refsource_VUPEN, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/36285 · vdb-entry, x_refsource_XF, x_transferred
  • securityfocus.com /bid/11903 · vdb-entry, x_refsource_BID, x_transferred
  • securitytracker.com /id?1018613 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • securityfocus.com /bid/11888 · vdb-entry, x_refsource_BID, x_transferred
  • osvdb.org /3476 · vdb-entry, x_refsource_OSVDB, x_transferred
  • securityfocus.com /bid/11905 · vdb-entry, x_refsource_BID, x_transferred
  • osvdb.org /3475 · vdb-entry, x_refsource_OSVDB, x_transferred
  • osvdb.org /3477 · vdb-entry, x_refsource_OSVDB, x_transferred
  • securityfocus.com /bid/11907 · vdb-entry, x_refsource_BID, x_transferred
  • osvdb.org /3479 · vdb-entry, x_refsource_OSVDB, x_transferred
  • securityfocus.com /bid/11882 · vdb-entry, x_refsource_BID, x_transferred
  • securityfocus.com /bid/11906 · vdb-entry, x_refsource_BID, x_transferred
  • securityfocus.com /bid/11880 · vdb-entry, x_refsource_BID, x_transferred
  • osvdb.org /3474 · vdb-entry, x_refsource_OSVDB, x_transferred
  • securityfocus.com /bid/11890 · vdb-entry, x_refsource_BID, x_transferred
  • securityfocus.com /bid/11894 · vdb-entry, x_refsource_BID, x_transferred
  • marc.info /?l=bugtraq&m=107394912715478&w=2 · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • securityfocus.com /bid/11868 · vdb-entry, x_refsource_BID, x_transferred
  • securityfocus.com /archive/1/477881/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.