CVE-2004-2656

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2004-12-31 · updated 2026-06-16

Description

Multiple cross-site scripting (XSS) vulnerabilities in Slashdot Like Automated Storytelling Homepage (Slash) (aka Slashcode) before R_2_5_0_41 allow remote attackers to inject arbitrary web script or HTML via (1) the topic parameter in search.pl and (2) the filter parameter in submit.pl.

Affected products

Open Source Development Network Slashcode: through r_2_5_0_41; 2.2.5

References

http://archives.neohapsis.com/archives/bugtraq/2004-12/0170.html
http://secunia.com/advisories/13491
http://www.osvdb.org/21874
http://www.osvdb.org/21875
http://www.securityfocus.com/bid/11993
http://www.slashcode.com/slash/04/12/20/1946225.shtml?tid=11&tid=5&tid=4
https://exchange.xforce.ibmcloud.com/vulnerabilities/18508
http://archives.neohapsis.com/archives/bugtraq/2004-12/0170.html
http://secunia.com/advisories/13491
http://www.osvdb.org/21874
http://www.osvdb.org/21875
http://www.securityfocus.com/bid/11993

Get alerted when CVE-2004-2656 or the next vulnerability affects your stack