CVE-2004-1825 json
Cross-site scripting (XSS) vulnerability in index.php in Mambo Open Source 4.5 stable 1.0.3 and earlier allows remote attackers to inject a…
published 2004-03-16 22 y ago modified 2026-06-16 4 mo ago also EUVD-2004-1818
- cvss
- 4.3
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.0%
- EPSS 2.0% chance of exploitation in 30 days, percentile 80%
- public exploits
- 1
- Exploit-DB
Summary
Cross-site scripting (XSS) vulnerability in index.php in Mambo Open Source 4.5 stable 1.0.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) return or (2) mos_change_template parameters.
Patch / fix
- secunia.com/advisories/11140 advisory
- osvdb.org/4665 advisory
Timeline
- First public exploit (EDB-23824)
- Published
Exploit prediction
1.97% chance of exploitation in the next 30 days, higher than 80% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-23824 Mambo Open Source 4.5 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities webapps, 2004-03-16
- secunia.com http://secunia.com/advisories/11140 referenced PoC, tagged "exploit" by a source, unverified
- osvdb.org http://www.osvdb.org/4665 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N |
References
-
secunia.com
/advisories/11140
third-party-advisory, exploit, patch, vendor-advisory
-
osvdb.org
/4665
vdb-entry, exploit, patch, vendor-advisory
-
securityfocus.com
/bid/9890
vdb-entry, vendor-advisory
-
exchange.xforce.ibmcloud.com
/vulnerabilities/15499
vdb-entry
-
osvdb.org
/4308
vdb-entry
-
marc.info
/?l=bugtraq&m=107945576020593&w=2
mailing-list
Sources
- CVE List CVE-2004-1825
- NVD CVE-2004-1825
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.