{"id":"CVE-2004-2138","aliases":["EUVD-2004-2130","GHSA-fff7-qc35-c5hv"],"status":"published","title":"Cross-site scripting (XSS) vulnerability in AWSguest.php in AllWebScripts MySQLGuest allows...","description":"Cross-site scripting (XSS) vulnerability in AWSguest.php in AllWebScripts MySQLGuest allows remote attackers to inject arbitrary HTML and PHP code via the (1) Name, (2) Email, (3) Homepage or (4) Comments field.","severity":{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01473,"percentile":0.73986,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2004-12-31T05:00:00Z","modified":"2026-06-16T22:09:05Z","products":[{"vendor":"allwebscripts","product":"mysqlguest"}],"references":[{"url":"http://www.computerknights.org/forum_viewtopic.php?2.122","tags":["x_refsource_MISC","x_transferred","Exploit","URL Repurposed"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/17462","tags":["vdb-entry","x_refsource_XF","x_transferred"]},{"url":"http://securitytracker.com/id?1011376","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"http://www.securityfocus.com/bid/11234","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2004-2138"},{"url":"https://github.com/advisories/GHSA-fff7-qc35-c5hv"}],"sources":{"cve":[{"id":"CVE-2004-2138","description":"Cross-site scripting (XSS) vulnerability in AWSguest.php in AllWebScripts MySQLGuest allows remote attackers to inject arbitrary HTML and PHP code via the (1) Name, (2) Email, (3) Homepage or (4) Comments field.","status":"published","published":"2005-06-30T04:00:00Z","modified":"2024-08-08T01:15:01.6Z","updated_at":"2026-11-02T14:34:53.357376Z"}],"euvd":[{"id":"EUVD-2004-2130","description":"Cross-site scripting (XSS) vulnerability in AWSguest.php in AllWebScripts MySQLGuest allows remote attackers to inject arbitrary HTML and PHP code via the (1) Name, (2) Email, (3) Homepage or (4) Comments field.","status":"published","published":"2005-06-30T04:00:00Z","modified":"2024-08-08T01:15:01Z","updated_at":"2026-11-03T01:15:11.805898Z"}],"ghsa":[{"id":"GHSA-fff7-qc35-c5hv","title":"Cross-site scripting (XSS) vulnerability in AWSguest.php in AllWebScripts MySQLGuest allows...","description":"Cross-site scripting (XSS) vulnerability in AWSguest.php in AllWebScripts MySQLGuest allows remote attackers to inject arbitrary HTML and PHP code via the (1) Name, (2) Email, (3) Homepage or (4) Comments field.","status":"published","published":"2022-04-29T03:00:52Z","modified":"2023-01-30T05:03:56Z","updated_at":"2026-11-02T14:46:56.128795Z"}],"nvd":[{"id":"CVE-2004-2138","description":"Cross-site scripting (XSS) vulnerability in AWSguest.php in AllWebScripts MySQLGuest allows remote attackers to inject arbitrary HTML and PHP code via the (1) Name, (2) Email, (3) Homepage or (4) Comments field.","status":"published","published":"2004-12-31T05:00:00Z","modified":"2026-06-16T22:09:05.08Z","cvss":[{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:00:52.459805Z"}]}}