CVE-2004-1913: XSS

Published Dec 31, 2004

Updated

Cross-site scripting (XSS) vulnerability in modules.php in NukeCalendar 1.1.a, as used in PHP-Nuke, allows remote attackers to inject arbitrary web script or HTML via the eid parameter.

Affected Software

2 affected components

Francisco Burzi PHP-Nuke=8.0_final

Shiba-design Nukecalendar=1.1.a

Event History

Dec 31, 2004

CVE Published

05:00 AM

May 10, 2005

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2004-1913?

CVE-2004-1913 is considered a moderate severity vulnerability due to its potential for cross-site scripting attacks allowing remote code injection.

How can I fix CVE-2004-1913?

To fix CVE-2004-1913, you should sanitize the input to the eid parameter in modules.php to prevent injection of arbitrary web scripts or HTML.

Which versions of PHP-Nuke are affected by CVE-2004-1913?

CVE-2004-1913 affects PHP-Nuke versions that utilize NukeCalendar 1.1.a, specifically PHP-Nuke 8.0_final.

What is the nature of the vulnerability in CVE-2004-1913?

CVE-2004-1913 is a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into web pages.

Who is the vendor for the affected software in CVE-2004-1913?

The affected software related to CVE-2004-1913 is provided by Francisco Burzi for PHP-Nuke and Shiba Design for NukeCalendar.