{"id":"CVE-2004-0067","aliases":["EUVD-2004-0067","GHSA-mhm2-pp6r-fp32"],"status":"published","title":"Multiple cross-site scripting (XSS) vulnerabilities in phpGedView before 2.65 allow remote...","description":"Multiple cross-site scripting (XSS) vulnerabilities in phpGedView before 2.65 allow remote attackers to inject arbitrary HTML or web script via (1) descendancy.php, (2) index.php, (3) individual.php, (4) login.php, (5) relationship.php, (6) source.php, (7) imageview.php, (8) calendar.php, (9) gedrecord.php, (10) login.php, and (11) gdbi_interface.php.  NOTE: some aspects of vector 10 were later reported to affect 4.1.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.03148,"percentile":0.8802,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-79"],"published":"2004-01-15T05:00:00Z","modified":"2026-06-16T22:04:51Z","exploits":[{"source":"exploitdb","id":"EDB-24810","title":"PHPGedView 2.x - 'Descendancy.php' Cross-Site Scripting","type":"webapps","platform":"php","date":"2004-01-19","verified":true,"url":"https://www.exploit-db.com/exploits/24810"},{"source":"exploitdb","id":"EDB-24814","title":"PHPGedView 2.5/2.6 - 'index.php' Cross-Site Scripting","type":"webapps","platform":"php","date":"2004-01-12","verified":true,"url":"https://www.exploit-db.com/exploits/24814"},{"source":"exploitdb","id":"EDB-24816","title":"PHPGedView 2.5/2.6 - 'Individual.php' Cross-Site Scripting","type":"webapps","platform":"php","date":"2004-01-12","verified":true,"url":"https://www.exploit-db.com/exploits/24816"},{"source":"exploitdb","id":"EDB-24819","title":"PHPGedView 2.5/2.6 - 'Source.php' Cross-Site Scripting","type":"webapps","platform":"php","date":"2004-01-12","verified":true,"url":"https://www.exploit-db.com/exploits/24819"},{"source":"exploitdb","id":"EDB-24820","title":"PHPGedView 2.5/2.6 - 'Imageview.php' Cross-Site Scripting","type":"webapps","platform":"php","date":"2004-01-12","verified":true,"url":"https://www.exploit-db.com/exploits/24820"},{"source":"exploitdb","id":"EDB-24821","title":"PHPGedView 2.5/2.6 - 'Gedrecord.php' Cross-Site Scripting","type":"webapps","platform":"php","date":"2004-01-12","verified":true,"url":"https://www.exploit-db.com/exploits/24821"},{"source":"exploitdb","id":"EDB-24822","title":"PHPGedView 2.5/2.6 - 'Gdbi_interface.php' Cross-Site Scripting","type":"webapps","platform":"php","date":"2004-01-12","verified":true,"url":"https://www.exploit-db.com/exploits/24822"},{"source":"exploitdb","id":"EDB-24829","title":"PHPGedView 2.5/2.6 - 'login.php?URL' Cross-Site Scripting","type":"webapps","platform":"php","date":"2004-01-12","verified":true,"url":"https://www.exploit-db.com/exploits/24829"},{"source":"exploitdb","id":"EDB-24830","title":"PHPGedView 2.5/2.6 - 'login.php?Username' Cross-Site Scripting","type":"webapps","platform":"php","date":"2004-01-12","verified":true,"url":"https://www.exploit-db.com/exploits/24830"},{"source":"exploitdb","id":"EDB-24831","title":"PHPGedView 2.5/2.6 - 'login.php' Newlanguage Cross-Site Scripting","type":"webapps","platform":"php","date":"2004-01-12","verified":true,"url":"https://www.exploit-db.com/exploits/24831"},{"source":"exploitdb","id":"EDB-24832","title":"PHPGedView 2.5/2.6 - 'Relationship.php' Cross-Site Scripting","type":"webapps","platform":"php","date":"2004-01-12","verified":true,"url":"https://www.exploit-db.com/exploits/24832"},{"source":"exploitdb","id":"EDB-24834","title":"PHPGedView 2.5/2.6 - 'calendar.php' Cross-Site Scripting","type":"webapps","platform":"php","date":"2004-01-12","verified":true,"url":"https://www.exploit-db.com/exploits/24834"},{"source":"exploitdb","id":"EDB-24835","title":"PHPGedView 2.5/2.6 - 'Placelist.php' SQL Injection","type":"webapps","platform":"php","date":"2004-01-12","verified":true,"url":"https://www.exploit-db.com/exploits/24835"},{"source":"exploitdb","id":"EDB-24837","title":"PHPGedView 2.5/2.6 - 'Timeline.php' SQL Injection","type":"webapps","platform":"php","date":"2004-01-12","verified":true,"url":"https://www.exploit-db.com/exploits/24837"}],"products":[{"vendor":"phpgedview","product":"phpgedview"}],"references":[{"url":"http://www.securityfocus.com/bid/11891","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://www.osvdb.org/3473","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"]},{"url":"http://secunia.com/advisories/26628","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory"]},{"url":"http://www.osvdb.org/3478","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/14212","tags":["vdb-entry","x_refsource_XF","x_transferred"]},{"url":"http://www.securityfocus.com/bid/11904","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://www.vupen.com/english/advisories/2007/2995","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","Vendor Advisory"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/36285","tags":["vdb-entry","x_refsource_XF","x_transferred"]},{"url":"http://www.securityfocus.com/bid/11903","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://securitytracker.com/id?1018613","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"http://www.securityfocus.com/bid/11888","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://www.osvdb.org/3476","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"]},{"url":"http://www.securityfocus.com/bid/11905","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://www.osvdb.org/3475","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"]},{"url":"http://www.osvdb.org/3477","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"]},{"url":"http://www.securityfocus.com/bid/11907","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://www.osvdb.org/3479","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"]},{"url":"http://www.securityfocus.com/bid/11882","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://www.securityfocus.com/bid/11906","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://www.securityfocus.com/bid/11880","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://www.osvdb.org/3474","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"]},{"url":"http://www.securityfocus.com/bid/11890","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://www.securityfocus.com/bid/11894","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://marc.info/?l=bugtraq\u0026m=107394912715478\u0026w=2","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"http://www.securityfocus.com/bid/11868","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://www.securityfocus.com/archive/1/477881/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2004-0067"},{"url":"https://github.com/advisories/GHSA-mhm2-pp6r-fp32"}],"sources":{"cve":[{"id":"CVE-2004-0067","description":"Multiple cross-site scripting (XSS) vulnerabilities in phpGedView before 2.65 allow remote attackers to inject arbitrary HTML or web script via (1) descendancy.php, (2) index.php, (3) individual.php, (4) login.php, (5) relationship.php, (6) source.php, (7) imageview.php, (8) calendar.php, (9) gedrecord.php, (10) login.php, and (11) gdbi_interface.php.  NOTE: some aspects of vector 10 were later reported to affect 4.1.","status":"published","published":"2004-01-15T05:00:00Z","modified":"2024-08-08T00:01:23.759Z","updated_at":"2026-11-02T14:34:54.758165Z"}],"euvd":[{"id":"EUVD-2004-0067","description":"Multiple cross-site scripting (XSS) vulnerabilities in phpGedView before 2.65 allow remote attackers to inject arbitrary HTML or web script via (1) descendancy.php, (2) index.php, (3) individual.php, (4) login.php, (5) relationship.php, (6) source.php, (7) imageview.php, (8) calendar.php, (9) gedrecord.php, (10) login.php, and (11) gdbi_interface.php.  NOTE: some aspects of vector 10 were later reported to affect 4.1.","status":"published","published":"2004-01-15T05:00:00Z","modified":"2024-08-08T00:01:23Z","updated_at":"2026-11-03T01:15:21.029087Z"}],"ghsa":[{"id":"GHSA-mhm2-pp6r-fp32","title":"Multiple cross-site scripting (XSS) vulnerabilities in phpGedView before 2.65 allow remote...","description":"Multiple cross-site scripting (XSS) vulnerabilities in phpGedView before 2.65 allow remote attackers to inject arbitrary HTML or web script via (1) descendancy.php, (2) index.php, (3) individual.php, (4) login.php, (5) relationship.php, (6) source.php, (7) imageview.php, (8) calendar.php, (9) gedrecord.php, (10) login.php, and (11) gdbi_interface.php.  NOTE: some aspects of vector 10 were later reported to affect 4.1.","status":"published","published":"2022-04-29T02:57:04Z","modified":"2023-01-30T05:02:24Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:46:37.595676Z"}],"nvd":[{"id":"CVE-2004-0067","description":"Multiple cross-site scripting (XSS) vulnerabilities in phpGedView before 2.65 allow remote attackers to inject arbitrary HTML or web script via (1) descendancy.php, (2) index.php, (3) individual.php, (4) login.php, (5) relationship.php, (6) source.php, (7) imageview.php, (8) calendar.php, (9) gedrecord.php, (10) login.php, and (11) gdbi_interface.php.  NOTE: some aspects of vector 10 were later reported to affect 4.1.","status":"published","published":"2004-02-17T05:00:00Z","modified":"2026-06-16T22:04:51.62Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:00:49.729639Z"}]}}