CVE-2004-1825

MediumCVSS 4.3/10Last modified Jun 16, 2026

Description

Cross-site scripting (XSS) vulnerability in index.php in Mambo Open Source 4.5 stable 1.0.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) return or (2) mos_change_template parameters.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://marc.info/?l=bugtraq&m=107945576020593&w=2
http://secunia.com/advisories/11140Exploit, Patch, Vendor Advisory
http://www.osvdb.org/4308
http://www.osvdb.org/4665Exploit, Patch, Vendor Advisory
http://www.securityfocus.com/bid/9890Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/15499
http://marc.info/?l=bugtraq&m=107945576020593&w=2
http://secunia.com/advisories/11140Exploit, Patch, Vendor Advisory
http://www.osvdb.org/4308
http://www.osvdb.org/4665Exploit, Patch, Vendor Advisory
http://www.securityfocus.com/bid/9890Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/15499

Timeline

Published: Mar 16, 2004
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2004

CVE-2004-18267.5SQL injection vulnerability in index.php in Mambo Open Source 4.5 stable 1.0.3 and earlier allows remote attackers to execute arbitrary SQL CVE-2004-18274.3Cross-site scripting (XSS) vulnerability in YaBB 1 Gold(SP1.3) and YaBB SE 1.5.1 Final allows remote attackers to inject arbitrary web scrip CVE-2004-18285.0Vcard 2.9 and possibly other versions does not require authorization to run uninstall.php, which could allow remote attackers to uninstall V CVE-2004-18294.3Multiple cross-site scripting (XSS) vulnerabilities in error.php in Gijza.net Error Manager 2.1 for PHP-Nuke 6.0 allow remote attackers to i CVE-2004-18305.0error.php in Error Manager 2.1 for PHP-Nuke 6.0 allows remote attackers to obtain sensitive information via an invalid (1) language, (2) new CVE-2004-18315.0Buffer overflow in Chrome 1.2.0.0 and earlier allows remote attackers to cause a denial of service (crash) via a packet with a large length CVE-2004-18325.0Buffer overflow in the GUI admin service in Mac OS X Server 10.3 allows remote attackers to cause a denial of service (crash and restart) vi CVE-2004-18337.5The admin.ib file in Borland Interbase 7.1 for Linux has default world writable permissions, which allows local users to gain database admin CVE-2004-18342.1mod_disk_cache in Apache 2.0 through 2.0.49 stores client headers, including authentication information, on the hard disk, which could allow CVE-2004-18357.5Multiple SQL injection vulnerabilities in index.php in Invision Gallery 1.0.1 allow remote attackers to execute arbitrary SQL via the (1) im CVE-2004-18367.5SQL injection vulnerability in index.php in Invision Power Top Site List 1.1 RC 2 and earlier allows remote attackers to execute arbitrary S CVE-2004-18374.3Cross-site scripting (XSS) vulnerability in Mod_survey 3.0.x before 3.0.16-pre2 and 3.2.x before 3.2.0-pre4 allows remote attackers to injec