{"id":"CVE-2004-2741","aliases":["EUVD-2004-2731","GHSA-hw95-r563-xw3w"],"status":"published","title":"Cross-site scripting (XSS) vulnerability in the \"help window\" (help.php) in Horde Application...","description":"Cross-site scripting (XSS) vulnerability in the \"help window\" (help.php) in Horde Application Framework 2.2.6 allows remote attackers to inject arbitrary web script or HTML via the (1) module, (2) topic, or (3) module parameters.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01263,"percentile":0.69847,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2004-12-31T05:00:00Z","modified":"2026-06-16T22:10:15Z","products":[{"vendor":"horde","product":"application_framework"}],"references":[{"url":"http://www.osvdb.org/11164","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"]},{"url":"http://www.securityfocus.com/bid/11546","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://secunia.com/advisories/12992","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Patch","Vendor Advisory"]},{"url":"http://lists.horde.org/archives/announce/2004/000107.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Patch"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/17881","tags":["vdb-entry","x_refsource_XF","x_transferred"]},{"url":"http://cvs.horde.org/diff.php/horde/templates/help/index.inc?r1=1.9.2.4\u0026r2=1.9.2.5\u0026ty=u","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://securitytracker.com/id?1011959","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2004-2741"},{"url":"https://github.com/advisories/GHSA-hw95-r563-xw3w"}],"sources":{"cve":[{"id":"CVE-2004-2741","description":"Cross-site scripting (XSS) vulnerability in the \"help window\" (help.php) in Horde Application Framework 2.2.6 allows remote attackers to inject arbitrary web script or HTML via the (1) module, (2) topic, or (3) module parameters.","status":"published","published":"2007-10-09T10:00:00Z","modified":"2024-08-08T01:36:25.317Z","updated_at":"2026-11-02T14:34:53.70484Z"}],"euvd":[{"id":"EUVD-2004-2731","description":"Cross-site scripting (XSS) vulnerability in the \"help window\" (help.php) in Horde Application Framework 2.2.6 allows remote attackers to inject arbitrary web script or HTML via the (1) module, (2) topic, or (3) module parameters.","status":"published","published":"2007-10-09T10:00:00Z","modified":"2024-08-08T01:36:25Z","updated_at":"2026-11-03T01:15:09.127613Z"}],"ghsa":[{"id":"GHSA-hw95-r563-xw3w","title":"Cross-site scripting (XSS) vulnerability in the \"help window\" (help.php) in Horde Application...","description":"Cross-site scripting (XSS) vulnerability in the \"help window\" (help.php) in Horde Application Framework 2.2.6 allows remote attackers to inject arbitrary web script or HTML via the (1) module, (2) topic, or (3) module parameters.","status":"published","published":"2022-04-29T03:02:01Z","modified":"2023-01-30T05:03:58Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:46:57.05202Z"}],"nvd":[{"id":"CVE-2004-2741","description":"Cross-site scripting (XSS) vulnerability in the \"help window\" (help.php) in Horde Application Framework 2.2.6 allows remote attackers to inject arbitrary web script or HTML via the (1) module, (2) topic, or (3) module parameters.","status":"published","published":"2004-12-31T05:00:00Z","modified":"2026-06-16T22:10:15.667Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:00:53.133049Z"}]}}