{"id":"CVE-2004-1640","aliases":["EUVD-2004-1634","GHSA-x6cc-4gc4-jf7f"],"status":"published","title":"Multiple cross-site scripting (XSS) vulnerabilities in XOOPS 0.94 and 1.0 allow remote attackers...","description":"Multiple cross-site scripting (XSS) vulnerabilities in XOOPS 0.94 and 1.0 allow remote attackers to execute arbitrary web script and HTML via the (1) terme parameter to search.php or (2) letter parameter to letter.php.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02143,"percentile":0.82191,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"published":"2004-08-28T04:00:00Z","modified":"2026-06-16T22:08:05Z","exploits":[{"source":"exploitdb","id":"EDB-24415","title":"Nagl XOOPS Dictionary Module 1.0 - Multiple Cross-Site Scripting Vulnerabilities","type":"webapps","platform":"php","date":"2004-08-28","verified":true,"url":"https://www.exploit-db.com/exploits/24415"}],"references":[{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/17154","tags":["vdb-entry","x_refsource_XF","x_transferred"]},{"url":"http://www.osvdb.org/9394","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"]},{"url":"http://cyruxnet.org/modulo_dic_xoops.htm","tags":["x_refsource_MISC","x_transferred"]},{"url":"http://www.securityfocus.com/bid/11064","tags":["vdb-entry","x_refsource_BID","x_transferred","Exploit","Vendor Advisory"]},{"url":"http://marc.info/?l=bugtraq\u0026m=109394077209963\u0026w=2","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/17152","tags":["vdb-entry","x_refsource_XF","x_transferred"]},{"url":"http://secunia.com/advisories/12424","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory"]},{"url":"http://www.osvdb.org/9393","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2004-1640"},{"url":"https://github.com/advisories/GHSA-x6cc-4gc4-jf7f"}],"sources":{"cve":[{"id":"CVE-2004-1640","description":"Multiple cross-site scripting (XSS) vulnerabilities in XOOPS 0.94 and 1.0 allow remote attackers to execute arbitrary web script and HTML via the (1) terme parameter to search.php or (2) letter parameter to letter.php.","status":"published","published":"2005-02-20T05:00:00Z","modified":"2024-08-08T01:00:36.779Z","updated_at":"2026-11-02T14:34:54.063504Z"}],"euvd":[{"id":"EUVD-2004-1634","description":"Multiple cross-site scripting (XSS) vulnerabilities in XOOPS 0.94 and 1.0 allow remote attackers to execute arbitrary web script and HTML via the (1) terme parameter to search.php or (2) letter parameter to letter.php.","status":"published","published":"2005-02-20T05:00:00Z","modified":"2024-08-08T01:00:36Z","updated_at":"2026-11-03T01:15:13.656749Z"}],"ghsa":[{"id":"GHSA-x6cc-4gc4-jf7f","title":"Multiple cross-site scripting (XSS) vulnerabilities in XOOPS 0.94 and 1.0 allow remote attackers...","description":"Multiple cross-site scripting (XSS) vulnerabilities in XOOPS 0.94 and 1.0 allow remote attackers to execute arbitrary web script and HTML via the (1) terme parameter to search.php or (2) letter parameter to letter.php.","status":"published","published":"2022-04-29T02:59:57Z","modified":"2023-01-30T05:03:40Z","updated_at":"2026-11-02T14:46:53.329839Z"}],"nvd":[{"id":"CVE-2004-1640","description":"Multiple cross-site scripting (XSS) vulnerabilities in XOOPS 0.94 and 1.0 allow remote attackers to execute arbitrary web script and HTML via the (1) terme parameter to search.php or (2) letter parameter to letter.php.","status":"published","published":"2004-08-28T04:00:00Z","modified":"2026-06-16T22:08:05.993Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:00:51.000028Z"}]}}