CVE-2004-1965 json
Multiple cross-site scripting (XSS) vulnerabilities in Open Bulletin Board (OpenBB) 1.0.6 and earlier allows remote attackers to inject arb…
published 2004-04-25 22 y ago modified 2026-06-16 4 mo ago also EUVD-2004-1957
- cvss
- 4.3
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 9.0%
- EPSS 9.0% chance of exploitation in 30 days, percentile 95%
- public exploits
- 5
- Exploit-DB, plus a Nuclei check
Summary
Multiple cross-site scripting (XSS) vulnerabilities in Open Bulletin Board (OpenBB) 1.0.6 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) redirect parameter to member.php, (2) to parameter to myhome.php (3) TID parameter to post.php, or (4) redirect parameter to index.php.
Timeline
- First public exploit (EDB-43811)
- Published
Exploit prediction
9.00% chance of exploitation in the next 30 days, higher than 95% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-43811 OpenBB < 1.0.6 - Multiple Vulnerabilities webapps, 2004-04-24
- EDB-24055 OpenBB 1.0.x - 'index.php?redirect' Cross-Site Scripting webapps, 2004-04-26
- EDB-24054 OpenBB 1.0.x - 'post.php?TID' Cross-Site Scripting webapps, 2004-04-26
- EDB-24053 OpenBB 1.0.x - 'myhome.php?to' Cross-Site Scripting webapps, 2004-04-26
- EDB-24052 OpenBB 1.0.x - 'member.php?redirect' Cross-Site Scripting webapps, 2004-04-26
- Nuclei template Open Bulletin Board (OpenBB) v1.0.6 - Open Redirect/XSS nuclei detection template
- securityfocus.com http://www.securityfocus.com/bid/10214 referenced PoC, tagged "exploit" by a source, unverified
- secunia.com http://secunia.com/advisories/11481 referenced PoC, tagged "exploit" by a source, unverified
- securitytracker.com http://securitytracker.com/id?1009935 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N |
References
-
securityfocus.com
/bid/10214
vdb-entry, exploit, vendor-advisory
-
secunia.com
/advisories/11481
third-party-advisory, exploit, vendor-advisory
-
securitytracker.com
/id?1009935
vdb-entry, exploit, vendor-advisory
-
exchange.xforce.ibmcloud.com
/vulnerabilities/15966
vdb-entry
-
marc.info
/?l=bugtraq&m=108301983206107&w=2
mailing-list
Sources
- CVE List CVE-2004-1965
- NVD CVE-2004-1965
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.