CVE-2004-1863

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2004-12-31 · updated 2026-06-16
Weakness: CWE-79

Description

Multiple cross-site scripting (XSS) vulnerabilities in XMB (aka extreme message board) 1.9 beta (aka Nexus beta) allow remote attackers to inject arbitrary web script or HTML via (1) the u2uheader parameter in editprofile.php, the restrict parameter in (2) member.php, (3) misc.php, and (4) today.php, and (5) an arbitrary parameter in phpinfo.php.

Affected products

Xmb Forum Xmb: 1.8_sp3, 1.9_beta

References

http://marc.info/?l=bugtraq&m=108032355905265&w=2
http://www.osvdb.org/14982
http://www.osvdb.org/14989
http://www.osvdb.org/14991
http://www.osvdb.org/16884
http://www.securityfocus.com/bid/9983
https://docs.xmbforum2.com/index.php?title=Security_Issue_History
https://exchange.xforce.ibmcloud.com/vulnerabilities/15654
http://marc.info/?l=bugtraq&m=108032355905265&w=2
http://www.osvdb.org/14982
http://www.osvdb.org/14989
http://www.osvdb.org/14991

Get alerted when CVE-2004-1863 or the next vulnerability affects your stack