CVE-2004-0358

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2004-11-23 · updated 2026-06-16

Description

Cross-site scripting (XSS) vulnerability in VirtuaNews Admin Panel Pro 1.0.3 allows remote attackers to execute arbitrary script as other users via (1) the mainnews parameter in admin.php, (2) the expand parameter in admin.php, (3) the id parameter in admin.php, (4) the catid parameter in admin.php, or (5) an unnamed parameter during the newslogo_upload action in admin.php.

Affected products

Virtuasystems Virtuanews Pro: 1.0, 1.0.1, 1.0.2, 1.0.3

References

http://archives.neohapsis.com/archives/bugtraq/2004-03/0069.html
http://marc.info/?l=bugtraq&m=107851556116088&w=2
http://www.securityfocus.com/bid/9812
http://www.securityfocus.com/bid/9819
https://exchange.xforce.ibmcloud.com/vulnerabilities/15402
http://archives.neohapsis.com/archives/bugtraq/2004-03/0069.html
http://marc.info/?l=bugtraq&m=107851556116088&w=2
http://www.securityfocus.com/bid/9812
http://www.securityfocus.com/bid/9819
https://exchange.xforce.ibmcloud.com/vulnerabilities/15402

Get alerted when CVE-2004-0358 or the next vulnerability affects your stack