Skip to content
Fencer Vulns
medium 4.3

CVE-2004-1621 json

NOTE: this issue has been disputed by the vendor.

published 2004-10-18 22 y ago modified 2026-06-16 4 mo ago also EUVD-2004-1615

cvss
4.3
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
3.1%
EPSS 3.1% chance of exploitation in 30 days, percentile 87%
public exploits
1
Exploit-DB

Summary

NOTE: this issue has been disputed by the vendor. Cross-site scripting (XSS) vulnerability in IBM Lotus Notes R6 and Domino R6, and possibly earlier versions, allows remote attackers to execute arbitrary web script or HTML via square brackets at the beginning and end of (1) computed for display, (2) computed when composed, or (3) computed text element fields. NOTE: the vendor has disputed this issue, saying that it is not a problem with Notes/Domino itself, but with the applications that do not properly handle this feature

Timeline

  1. First public exploit (EDB-24690)
  2. Published

Exploit prediction

3.08% chance of exploitation in the next 30 days, higher than 87% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • EDB-24690 IBM Lotus Domino 6.x - Cross-Site Scripting / HTML Injection webapps, 2004-10-18
  • secunia.com http://secunia.com/advisories/12891 referenced PoC, tagged "exploit" by a source, unverified
  • securityfocus.com http://www.securityfocus.com/bid/11458 referenced PoC, tagged "exploit" by a source, unverified
  • securitytracker.com http://securitytracker.com/id?1011779 referenced PoC, tagged "exploit" by a source, unverified
  • www-1.ibm.com http://www-1.ibm.com/support/docview.wss?rs=463&uid=swg21187833 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.