First day on Intigriti: our agent harness found and proved a remote code execution bug, paid €3,000.

CVE-2004-2776

CriticalCVSS 9.8/10Last modified Jun 16, 2026

Description

go.cgi in GoScript 2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) query string or (2) artarchive parameter.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://marc.info/?l=bugtraq&m=109164242705572&w=2Exploit, Third Party Advisory
http://openwall.com/lists/oss-security/2013/12/12/8Mailing List, Third Party Advisory
https://github.com/mikaku/Monitorix/issues/30Exploit, Issue Tracking, Third Party Advisory
http://marc.info/?l=bugtraq&m=109164242705572&w=2Exploit, Third Party Advisory
http://openwall.com/lists/oss-security/2013/12/12/8Mailing List, Third Party Advisory
https://github.com/mikaku/Monitorix/issues/30Exploit, Issue Tracking, Third Party Advisory

Timeline

Published: Dec 31, 2019
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2004

CVE-2004-277710.0GE Healthcare Centricity Image Vault 3.x has a password of (1) gemnet for the administrator account, (2) webadmin for the webadmin administr CVE-2004-27787.1Ebuild in Gentoo may change directory and file permissions depending on the order of installed packages, which allows local users to read or CVE-2004-27797.5id3_utf16_deserialize() in utf16.c in libid3tag through 0.15.1b misparses ID3v2 tags encoded in UTF-16 with an odd number of bytes, triggeri