CVE-2004-0474

Help Center (HelpCtr.exe) may allow remote attackers to read or execute arbitrary files via an ...

5.1 MediumPublic exploit

Help Center (HelpCtr.exe) may allow remote attackers to read or execute arbitrary files via an "http://" or "file://" argument to the topic parameter in an hcp:// URL. NOTE: since the initial report of this problem, several researchers have been unable to reproduce this issue.

Exploit likelihood

16.2%Down 13.2 points since Feb 4, 2022

What each source reports

NVD Score used 5.1

Record: CVE-2004-0474
CVSS 2.0: 5.1 MediumAV:N/AC:H/Au:N/C:P/I:P/A:P
Updated: 2026-11-02

CVE List No score

Record: CVE-2004-0474
Updated: 2026-11-02

EUVDEUVD-2004-0473 No score

Record: EUVD-2004-0473
Updated: 2026-11-03

GitHub AdvisoriesGHSA-7mwf-cmrh-q8j4 No score

Help Center (HelpCtr.exe) may allow remote attackers to read or execute arbitrary files via an ...

Record: GHSA-7mwf-cmrh-q8j4
Updated: 2026-11-02

Affected products

microsoft windows xp

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Microsoft Windows XP - HCP URI Handler Arbitrary Command Execution	2004-02-09

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2004-0474 is a medium vulnerability (CVSS 5.1) in Microsoft Windows Xp, published May 20, 2004. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 16.2%, the 96th percentile. No source names a fixed version.