vulnwire
4.3med

CVE-2004-03223 exploits

Multiple cross-site scripting (XSS) vulnerabilities in XMB 1.8 Final SP2 allow remote attackers to execute arbitrary script as other users…

Published 22 y ago · modified 4 mo ago · JSON

CVSS
4.3
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
4.8%
percentile 92%
Public exploits
3
Exploit-DB

Multiple cross-site scripting (XSS) vulnerabilities in XMB 1.8 Final SP2 allow remote attackers to execute arbitrary script as other users via the (1) member parameter in member.php, (2) uid parameter in u2uadmin.php, (3) user parameter in editprofile.php, (4) an onmouseover event in an align tag when bbcode is allowed, or (5) img tag where bbcode is allowed.

Exploit prediction (EPSS)

4.84% probability of exploitation in the next 30 days, higher than 92% of all scored CVEs.

Exploits and detections

  • EDB-23747 XMB Forum 1.8 - BBcode align Tag Cross-Site Scripting · webapps · 2004-02-23
  • EDB-23746 XMB Forum 1.8 - 'editprofile.php?user' Cross-Site Scripting · webapps · 2004-02-23
  • EDB-23745 XMB Forum 1.8 - 'u2uadmin.php?uid' Cross-Site Scripting · webapps · 2004-02-23

CVSS scores

Assigned byVersionScoreVector
NVD2.04.3AV:N/AC:M/Au:N/C:N/I:P/A:N

References

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.