CVE-2004-2085

Description

Multiple cross-site scripting (XSS) vulnerabilities in Brad Fears phpCodeCabinet 0.4 and earlier allow remote attackers to inject arbitrary web script or HTML via multiple parameters, including (1) the sid parameter to comments.php, (2) the cid, cf, or rfd parameters to category.php, or the cid parameter to (3) input.php, (4) browse.php, (5) themes/facade/header.php, or (6) themes/phpcc/header.php.

4.3

CVSS

Severity: Medium

CVSS 2.0 •

EPSS 3.09% Top 15%

Vendor Advisory sourceforge.net Vendor Advisory sourceforge.net Vendor Advisory sourceforge.net Vendor Advisory sourceforge.net Vendor Advisory sourceforge.net Vendor Advisory sourceforge.net Vendor Advisory sourceforge.net Vendor Advisory osvdb.org Vendor Advisory osvdb.org Vendor Advisory osvdb.org Vendor Advisory securityfocus.com Vendor Advisory securityfocus.com

Affected: n/a n/a

References

Link	Tags
http://secunia.com/advisories/10862	third party advisory
http://cvs.sourceforge.net/viewcvs.py/phpcodecabinet/phpcc/comments.php?r1=1.1&r2=1.2	vendor advisory
http://cvs.sourceforge.net/viewcvs.py/phpcodecabinet/phpcc/category.php?r1=1.4&r2=1.5	vendor advisory
http://cvs.sourceforge.net/viewcvs.py/phpcodecabinet/phpcc/browse.php?r1=1.5&r2=1.6	vendor advisory
http://cvs.sourceforge.net/viewcvs.py/phpcodecabinet/phpcc/themes/facade/header.php?r1=1.4&r2=1.5	vendor advisory
http://securitytracker.com/id?1009012	vdb entry
http://cvs.sourceforge.net/viewcvs.py/phpcodecabinet/phpcc/input.php?r1=1.7&r2=1.8	vendor advisory
http://cvs.sourceforge.net/viewcvs.py/phpcodecabinet/phpcc/themes/phpcc/header.php?r1=1.4&r2=1.5	vendor advisory
http://www.osvdb.org/16711	vdb entry
http://sourceforge.net/project/shownotes.php?release_id=214860	vendor advisory
http://www.osvdb.org/3886	vdb entry patch vendor advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/15190	vdb entry
http://www.osvdb.org/3885	vdb entry vendor advisory
http://www.osvdb.org/16710	vdb entry
http://www.osvdb.org/3887	vdb entry patch vendor advisory
http://www.securityfocus.com/bid/9645	vdb entry patch vendor advisory
http://www.securityfocus.com/bid/9601	vdb entry patch vendor advisory

Frequently Asked Questions

What is the severity of CVE-2004-2085?: CVE-2004-2085 has been scored as a medium severity vulnerability.
How to fix CVE-2004-2085?: To fix CVE-2004-2085, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2004-2085 being actively exploited in the wild?: It is possible that CVE-2004-2085 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~3% probability that this vulnerability will be exploited by malicious actors in the next 30 days.