Cross-site scripting (XSS) vulnerability in Fastream NETFile Server 6.0.3.588 allows remote attackers to inject arbitrary web script or HTM…

1. 2003-10-28 First public exploit (EDB-23307)
2. 2003-10-28 Published

1.87% chance of exploitation in the next 30 days, higher than 79% of all scored CVEs (FIRST EPSS, 2026-11-08).

• EDB-23307 Fastream NetFile 6.0.3.588 - Error Message Cross-Site Scripting remote, 2003-10-28
• osvdb.org http://www.osvdb.org/2732 referenced PoC, tagged "exploit" by a source, unverified
• securityfocus.com http://www.securityfocus.com/bid/8908 referenced PoC, tagged "exploit" by a source, unverified
• securitytracker.com http://securitytracker.com/id?1008020 referenced PoC, tagged "exploit" by a source, unverified
• securityfocus.com http://www.securityfocus.com/archive/1/342678 referenced PoC, tagged "exploit" by a source, unverified
• secunia.com http://secunia.com/advisories/10099 referenced PoC, tagged "exploit" by a source, unverified

Weakness

• CWE-79 Improper Neutralization of Input During Web Page Generation

• osvdb.org /2732

  vdb-entry, exploit, vendor-advisory

• securityfocus.com /bid/8908

  vdb-entry, exploit, vendor-advisory

• securitytracker.com /id?1008020

  vdb-entry, exploit, vendor-advisory

• securityfocus.com /archive/1/342678

  mailing-list, exploit, vendor-advisory

• secunia.com /advisories/10099

  third-party-advisory, exploit, vendor-advisory

• exchange.xforce.ibmcloud.com /vulnerabilities/13535

  vdb-entry

• CVE List CVE-2003-1151
• NVD CVE-2003-1151

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.