{"id": "CVE-2004-1845", "bulletinFamily": "NVD", "title": "CVE-2004-1845", "description": "Multiple cross-site scripting (XSS) vulnerabilities in News Manager Lite 2.5 allow remote attackers to inject arbitrary web script or HTML via the (1) email parameter to comment_add.asp, (2) search parameter to search.asp, or (3) n parameter to category_news_headline.asp.", "published": "2004-12-31T00:00:00", "modified": "2017-07-10T21:31:23", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2004-1845", "reporter": "NVD", "references": ["https://exchange.xforce.ibmcloud.com/vulnerabilities/15548", "http://marc.info/?l=bugtraq&m=107999733503496&w=2", "http://www.securityfocus.com/bid/9935", "http://securitytracker.com/id?1009507"], "cvelist": ["CVE-2004-1845"], "type": "cve", "lastseen": "2017-07-11T11:14:37", "history": [{"bulletin": {"assessment": {"href": "", "name": "", "system": ""}, "bulletinFamily": "NVD", "cpe": ["cpe:/a:expinion.net:news_manager_lite:2.5"], "cvelist": ["CVE-2004-1845"], "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}, "description": "Multiple cross-site scripting (XSS) vulnerabilities in News Manager Lite 2.5 allow remote attackers to inject arbitrary web script or HTML via the (1) email parameter to comment_add.asp, (2) search parameter to search.asp, or (3) n parameter to category_news_headline.asp.", "edition": 1, "hash": "8cb74069b57a8abb2a1fced939470e3018870f88e86dbab3f3a6029cd949681e", "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "scanner"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "reporter"}, {"hash": "6e9bdd2021503689a2ad9254c9cdf2b3", "key": "cvss"}, {"hash": "56765472680401499c79732468ba4340", "key": "objectVersion"}, {"hash": "fde42cec59d52f90c699965375fece76", "key": "cpe"}, {"hash": "6d3f4796275bb54c21a33b82f399cc6d", "key": "assessment"}, {"hash": "813455262affa441c66feeba67e82bb2", "key": "references"}, {"hash": "25959ae8fd5787ef616d0d8f7c0d51db", "key": "modified"}, {"hash": "8d01b3f7405442a63e5c8249be351108", "key": "published"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "c1e6940d848898429e6587906a52e683", "key": "cvelist"}, {"hash": "7583f4c387c5fa16d5b66ee82b211560", "key": "href"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "5982fe4ca7d685a0e692043983f2974f", "key": "title"}, {"hash": "386c262bf90ee99bab6ab2ab36efa610", "key": "description"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2004-1845", "id": "CVE-2004-1845", "lastseen": "2016-09-03T04:42:55", "modified": "2008-09-05T16:42:30", "objectVersion": "1.2", "published": "2004-12-31T00:00:00", "references": ["http://www.securityfocus.com/bid/9935", "http://securitytracker.com/id?1009507", "http://marc.theaimsgroup.com/?l=bugtraq&m=107999733503496&w=2", "http://xforce.iss.net/xforce/xfdb/15548"], "reporter": "NVD", "scanner": [], "title": "CVE-2004-1845", "type": "cve", "viewCount": 0}, "differentElements": ["references", "modified"], "edition": 1, "lastseen": "2016-09-03T04:42:55"}, {"bulletin": {"assessment": {"href": "", "name": "", "system": ""}, "bulletinFamily": "NVD", "cpe": ["cpe:/a:expinion.net:news_manager_lite:2.5"], "cvelist": ["CVE-2004-1845"], "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}, "description": "Multiple cross-site scripting (XSS) vulnerabilities in News Manager Lite 2.5 allow remote attackers to inject arbitrary web script or HTML via the (1) email parameter to comment_add.asp, (2) search parameter to search.asp, or (3) n parameter to category_news_headline.asp.", "edition": 2, "enchantments": {}, "hash": "9a7cb6fff9e631e3323ed6a344e5cf06909217ad21f46a116e16f48dda802006", "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "scanner"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "reporter"}, {"hash": "6e9bdd2021503689a2ad9254c9cdf2b3", "key": "cvss"}, {"hash": "fde42cec59d52f90c699965375fece76", "key": "cpe"}, {"hash": "6d3f4796275bb54c21a33b82f399cc6d", "key": "assessment"}, {"hash": "8d01b3f7405442a63e5c8249be351108", "key": "published"}, {"hash": "7574c021b11a04965a7a3de01ab521ab", "key": "modified"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "c1e6940d848898429e6587906a52e683", "key": "cvelist"}, {"hash": "7583f4c387c5fa16d5b66ee82b211560", "key": "href"}, {"hash": "715c8bcad4783f45368e6c1761e26aec", "key": "references"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "5982fe4ca7d685a0e692043983f2974f", "key": "title"}, {"hash": "386c262bf90ee99bab6ab2ab36efa610", "key": "description"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2004-1845", "id": "CVE-2004-1845", "lastseen": "2017-04-18T15:50:38", "modified": "2016-10-17T23:01:33", "objectVersion": "1.2", "published": "2004-12-31T00:00:00", "references": ["http://marc.info/?l=bugtraq&m=107999733503496&w=2", "http://www.securityfocus.com/bid/9935", "http://securitytracker.com/id?1009507", "http://xforce.iss.net/xforce/xfdb/15548"], "reporter": "NVD", "scanner": [], "title": "CVE-2004-1845", "type": "cve", "viewCount": 0}, "differentElements": ["references", "modified"], "edition": 2, "lastseen": "2017-04-18T15:50:38"}], "edition": 3, "hashmap": [{"key": "assessment", "hash": "6d3f4796275bb54c21a33b82f399cc6d"}, {"key": "bulletinFamily", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "cpe", "hash": "fde42cec59d52f90c699965375fece76"}, {"key": "cvelist", "hash": "c1e6940d848898429e6587906a52e683"}, {"key": "cvss", "hash": "6e9bdd2021503689a2ad9254c9cdf2b3"}, {"key": "description", "hash": "386c262bf90ee99bab6ab2ab36efa610"}, {"key": "href", "hash": "7583f4c387c5fa16d5b66ee82b211560"}, {"key": "modified", "hash": "a5bed87da812411d21f749b20240d7cb"}, {"key": "published", "hash": "8d01b3f7405442a63e5c8249be351108"}, {"key": "references", "hash": "efd9e8d8654221a902cae28f836454a7"}, {"key": "reporter", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "scanner", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "title", "hash": "5982fe4ca7d685a0e692043983f2974f"}, {"key": "type", "hash": "1716b5fcbb7121af74efdc153d0166c5"}], "hash": "426881bc59798faa4e47a044f8260d612cac8e1e2fa126f613e4ff97b82210ea", "viewCount": 0, "enchantments": {"score": {"value": 4.3, "vector": "NONE", "modified": "2017-07-11T11:14:37"}, "dependencies": {"references": [{"type": "exploitdb", "idList": ["EDB-ID:23857", "EDB-ID:23859", "EDB-ID:23858"]}], "modified": "2017-07-11T11:14:37"}, "vulnersScore": 4.3}, "objectVersion": "1.3", "cpe": ["cpe:/a:expinion.net:news_manager_lite:2.5"], "assessment": {"href": "", "name": "", "system": ""}, "scanner": []}

{"exploitdb": [{"lastseen": "2016-02-02T21:57:51", "bulletinFamily": "exploit", "description": "Expinion.net News Manager Lite 2.5 comment_add.asp XSS. CVE-2004-1845. Webapps exploit for asp platform", "modified": "2004-03-20T00:00:00", "published": "2004-03-20T00:00:00", "id": "EDB-ID:23857", "href": "https://www.exploit-db.com/exploits/23857/", "type": "exploitdb", "title": "Expinion.net News Manager Lite 2.5 comment_add.asp XSS", "sourceData": "source: http://www.securityfocus.com/bid/9935/info\r\n\r\nMultiple vulnerabilities have been identified in the application that may allow an attacker to carry out SQL injection, cross-site scripting, and account hijacking attacks.\r\n\r\nThe issues exist in the 'comment_add.asp', 'search.asp', 'category_news_headline.asp', 'more.asp', 'category_news.asp', and 'ews_sort.asp' scripts. Further more a cookie account hijacking issue was also discovered in the application that may allow a remote attacker to gain administrative access to application's administrative interface.\r\n\r\nNews Manager Lite 2.5 is reported to be affected by these issues, however, other versions may be affected as well.\r\n\r\nhttp://www.example.com/comment_add.asp?ID=3&email=[XSS]", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}, "sourceHref": "https://www.exploit-db.com/download/23857/"}, {"lastseen": "2016-02-02T21:58:06", "bulletinFamily": "exploit", "description": "Expinion.net News Manager Lite 2.5 category_news_headline.asp XSS. CVE-2004-1845. Webapps exploit for asp platform", "modified": "2004-03-20T00:00:00", "published": "2004-03-20T00:00:00", "id": "EDB-ID:23859", "href": "https://www.exploit-db.com/exploits/23859/", "type": "exploitdb", "title": "Expinion.net News Manager Lite 2.5 category_news_headline.asp XSS", "sourceData": "source: http://www.securityfocus.com/bid/9935/info\r\n \r\nMultiple vulnerabilities have been identified in the application that may allow an attacker to carry out SQL injection, cross-site scripting, and account hijacking attacks.\r\n \r\nThe issues exist in the 'comment_add.asp', 'search.asp', 'category_news_headline.asp', 'more.asp', 'category_news.asp', and 'ews_sort.asp' scripts. Further more a cookie account hijacking issue was also discovered in the application that may allow a remote attacker to gain administrative access to application's administrative interface.\r\n \r\nNews Manager Lite 2.5 is reported to be affected by these issues, however, other versions may be affected as well.\r\n\r\nhttp://www.example.com/category_news_headline.asp?ID=2&n=[XSS]", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}, "sourceHref": "https://www.exploit-db.com/download/23859/"}, {"lastseen": "2016-02-02T21:57:59", "bulletinFamily": "exploit", "description": "Expinion.net News Manager Lite 2.5 search.asp XSS. CVE-2004-1845. Webapps exploit for asp platform", "modified": "2004-03-20T00:00:00", "published": "2004-03-20T00:00:00", "id": "EDB-ID:23858", "href": "https://www.exploit-db.com/exploits/23858/", "type": "exploitdb", "title": "Expinion.net News Manager Lite 2.5 - search.asp XSS", "sourceData": "source: http://www.securityfocus.com/bid/9935/info\r\n \r\nMultiple vulnerabilities have been identified in the application that may allow an attacker to carry out SQL injection, cross-site scripting, and account hijacking attacks.\r\n \r\nThe issues exist in the 'comment_add.asp', 'search.asp', 'category_news_headline.asp', 'more.asp', 'category_news.asp', and 'ews_sort.asp' scripts. Further more a cookie account hijacking issue was also discovered in the application that may allow a remote attacker to gain administrative access to application's administrative interface.\r\n \r\nNews Manager Lite 2.5 is reported to be affected by these issues, however, other versions may be affected as well.\r\n\r\nhttp://www.example.com/search.asp?search=[XSS]", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}, "sourceHref": "https://www.exploit-db.com/download/23858/"}]}