CVE-2004-0323

Multiple SQL injection vulnerabilities in XMB 1.8 Final SP2 allow remote attackers to inject...

7.5 HighPublic exploit

Multiple SQL injection vulnerabilities in XMB 1.8 Final SP2 allow remote attackers to inject arbitrary SQL and gain privileges via the (1) ppp parameter in viewthread.php, (2) desc parameter in misc.php, (3) tpp parameter in forumdisplay.php, (4) ascdesc parameter in forumdisplay.php, or (5) the addon parameter in stats.php. NOTE: it has also been shown that item (3) is also in XMB 1.9 beta.

Exploit likelihood

4.02%Up 2.9 points since Feb 4, 2022

What each source reports

NVD Score used 7.5

Record: CVE-2004-0323
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Updated: 2026-11-02

CVE List No score

Record: CVE-2004-0323
Updated: 2026-11-02

EUVDEUVD-2004-0323 No score

Record: EUVD-2004-0323
Updated: 2026-11-03

GitHub AdvisoriesGHSA-rp6m-6h7f-9mhj No score

Multiple SQL injection vulnerabilities in XMB 1.8 Final SP2 allow remote attackers to inject...

Record: GHSA-rp6m-6h7f-9mhj
Updated: 2026-11-02

Affected products

xmb forum xmb

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	XMB Forum 1.8 - 'forumdisplay.php' Multiple SQL Injections	2004-02-23

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2004-0323 is a high vulnerability (CVSS 7.5) in Xmb Forum Xmb, published March 18, 2004. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 4.02%, the 90th percentile. No source names a fixed version.