Skip to content
Fencer Vulns
medium 4.3

CVE-2004-0067 json

Multiple cross-site scripting (XSS) vulnerabilities in phpGedView before 2.65 allow remote attackers to inject arbitrary HTML or web script…

published 2004-01-15 22 y ago modified 2026-06-16 4 mo ago also EUVD-2004-0067

cvss
4.3
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
3.1%
EPSS 3.1% chance of exploitation in 30 days, percentile 88%
public exploits
14
Exploit-DB

Summary

Multiple cross-site scripting (XSS) vulnerabilities in phpGedView before 2.65 allow remote attackers to inject arbitrary HTML or web script via (1) descendancy.php, (2) index.php, (3) individual.php, (4) login.php, (5) relationship.php, (6) source.php, (7) imageview.php, (8) calendar.php, (9) gedrecord.php, (10) login.php, and (11) gdbi_interface.php. NOTE: some aspects of vector 10 were later reported to affect 4.1.

Timeline

  1. First public exploit (EDB-24837)
  2. Published

Exploit prediction

3.15% chance of exploitation in the next 30 days, higher than 88% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • EDB-24837 PHPGedView 2.5/2.6 - 'Timeline.php' SQL Injection webapps, 2004-01-12
  • EDB-24835 PHPGedView 2.5/2.6 - 'Placelist.php' SQL Injection webapps, 2004-01-12
  • EDB-24834 PHPGedView 2.5/2.6 - 'calendar.php' Cross-Site Scripting webapps, 2004-01-12
  • EDB-24832 PHPGedView 2.5/2.6 - 'Relationship.php' Cross-Site Scripting webapps, 2004-01-12
  • EDB-24831 PHPGedView 2.5/2.6 - 'login.php' Newlanguage Cross-Site Scripting webapps, 2004-01-12
  • EDB-24830 PHPGedView 2.5/2.6 - 'login.php?Username' Cross-Site Scripting webapps, 2004-01-12
  • EDB-24829 PHPGedView 2.5/2.6 - 'login.php?URL' Cross-Site Scripting webapps, 2004-01-12
  • EDB-24822 PHPGedView 2.5/2.6 - 'Gdbi_interface.php' Cross-Site Scripting webapps, 2004-01-12
  • EDB-24821 PHPGedView 2.5/2.6 - 'Gedrecord.php' Cross-Site Scripting webapps, 2004-01-12
  • EDB-24820 PHPGedView 2.5/2.6 - 'Imageview.php' Cross-Site Scripting webapps, 2004-01-12
  • EDB-24819 PHPGedView 2.5/2.6 - 'Source.php' Cross-Site Scripting webapps, 2004-01-12
  • EDB-24816 PHPGedView 2.5/2.6 - 'Individual.php' Cross-Site Scripting webapps, 2004-01-12
  • EDB-24814 PHPGedView 2.5/2.6 - 'index.php' Cross-Site Scripting webapps, 2004-01-12
  • EDB-24810 PHPGedView 2.x - 'Descendancy.php' Cross-Site Scripting webapps, 2004-01-19

CVSS scores

assigned by version score vector
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.