CVE-2004-2245

MediumCVSS 4.3/10Last modified Jun 16, 2026

Description

Cross-site scripting (XSS) vulnerability in Goollery 0.03 allows remote attackers to inject arbitrary HTML or web script via the (1) page parameter to viewalbum.php or (2) btopage parameter to viewpic.php.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://securitytracker.com/id?1012062Exploit
http://www.osvdb.org/11318
http://www.osvdb.org/11319Exploit, Patch
http://www.osvdb.org/11320Exploit, Patch
http://www.osvdb.org/ref/11/11xxx-goollery_multiple.txtExploit
http://www.securityfocus.com/bid/11587Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/17957
http://securitytracker.com/id?1012062Exploit
http://www.osvdb.org/11318
http://www.osvdb.org/11319Exploit, Patch
http://www.osvdb.org/11320Exploit, Patch
http://www.osvdb.org/ref/11/11xxx-goollery_multiple.txtExploit
http://www.securityfocus.com/bid/11587Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/17957

Timeline

Published: Dec 31, 2004
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2004

CVE-2004-22464.3Cross-site scripting (XSS) vulnerability in Goollery before 0.04b allows remote attackers to inject arbitrary HTML or web script via the con CVE-2004-224710.0Unknown vulnerability in the "admin of paypal email addresses" in AudienceConnect before 1.0.beta.21 has unknown impact and attack vectors.CVE-2004-224810.0Unknown vulnerability in RemoteEditor before 0.1.1 has unknown impact and attack vectors, related to "oversize submissions."CVE-2004-22497.5Unknown vulnerability in the "access code" in SecureEditor before 0.1.2 has unknown impact and attack vectors, possibly involving a bypass o CVE-2004-22507.5Unknown vulnerability in the "access code" in RemoteEditor before 0.1.6 has unknown impact and attack vectors, possibly involving a bypass o CVE-2004-22515.0The PPTP server in Astaro Security Linux before 4.024 provides information about its version, which makes it easier for remote attackers to CVE-2004-22525.0The firewall in Astaro Security Linux before 4.024 sends responses to SYN-FIN packets, which makes it easier for remote attackers to obtain CVE-2004-22535.0Directory traversal vulnerability in user.cgi in SurgeLDAP 1.0g and earlier allows remote attackers to read arbitrary files via a .. in the CVE-2004-22547.5SurgeLDAP 1.0g (Build 12), and possibly other versions before 1.0h, allows remote attackers to bypass authentication for the administration CVE-2004-22556.4Directory traversal vulnerability in phpMyFAQ 1.3.12 allows remote attackers to read arbitrary files, and possibly execute local PHP files, CVE-2004-22565.0Directory traversal vulnerability in phpMyFAQ 1.4.0 alpha allows remote attackers to read arbitrary files, and possibly execute local PHP fi CVE-2004-22575.3phpMyFAQ 1.4.0 allows remote attackers to access the Image Manager to upload or delete images without authorization via a direct request.