CVE-2004-2574

MediumCVSS 4.3/10Last modified Jun 16, 2026

Description

Cross-site scripting (XSS) vulnerability in index.php in phpGroupWare 0.9.14.005 and earlier allows remote attackers to inject arbitrary web script or HTML via the date parameter in a calendar.uicalendar.planner menuaction.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.osvdb.org/7600Exploit
http://www.securityfocus.com/bid/12082Exploit, Patch
https://savannah.gnu.org/bugs/?func=detailitem&item_id=7478Exploit
http://www.osvdb.org/7600Exploit
http://www.securityfocus.com/bid/12082Exploit, Patch
https://savannah.gnu.org/bugs/?func=detailitem&item_id=7478Exploit

Timeline

Published: Dec 31, 2004
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2004

CVE-2004-25755.0phpGroupWare 0.9.14.005 and earlier allow remote attackers to obtain sensitive information via a direct request to (1) hook_admin.inc.php, (CVE-2004-25765.0class.vfs_dav.inc.php in phpGroupWare 0.9.16.000 does not create .htaccess files to enable authorization checks for access to users' home-di CVE-2004-25775.0The acl_check function in phpGroupWare 0.9.16RC2 always returns True, even when mkdir does not behave as expected, which could allow remote CVE-2004-25785.0phpGroupWare before 0.9.16.002 transmits the (1) header admin and (2) setup passwords in plaintext via cookies, which allows remote attacker CVE-2004-25797.5ACLCHECK module in Novell iChain 2.3 allows attackers to bypass access control rules of an unspecified component via an unspecified attack v CVE-2004-25805.8Cross-site scripting (XSS) vulnerability in Novell iChain 2.3 allows remote attackers to obtain login credentials via unspecified vectors.CVE-2004-25815.0Novell iChain 2.3 allows attackers to cause a denial of service via a URL with a "specific string."CVE-2004-25825.0Novell iChain 2.3 includes the build number in the VIA line of the proxy server's HTTP headers, which allows remote attackers to obtain sens CVE-2004-25837.8SMTP service in SmarterTools SmarterMail 1.6.1511 and 1.6.1529 allows remote attackers to cause a denial of service (CPU consumption) via a CVE-2004-25844.0frmAddfolder.aspx in SmarterTools SmarterMail 1.6.1511 and 1.6.1529 allows remote authenticated users to create a folder that SmarterMail ca CVE-2004-25854.3Cross-site scripting (XSS) vulnerability in frmCompose.aspx in SmarterTools SmarterMail 1.6.1511 and 1.6.1529 allows remote attackers to inj CVE-2004-25865.0Directory traversal vulnerability in frmGetAttachment.aspx in SmarterTools SmarterMail 1.6.1511 and 1.6.1529 allows remote attackers to read