CVE-2004-2411

🗓️ 18 Aug 2005 04:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov👁 42 Views🌐 WEB

The CleanseMessage function in shop$db.asp for VP-ASP Shopping Cart 4.0 through 5.0 does not sufficiently cleanse inputs, enabling XSS attacks

Reporter	Title	Published	Views	Family All 4
Cvelist	CVE-2004-2411	18 Aug 200504:00	–	cvelist
Exploit DB	Virtual Programming VP-ASP Shoperror Script 4/5 - Cross-Site Scripting	14 Jun 200400:00	–	exploitdb
EUVD	EUVD-2004-2402	7 Oct 202500:30	–	euvd
NVD	CVE-2004-2411	31 Dec 200405:00	–	nvd

NVD

Node

Source	Link
vpasp	www.vpasp.com/virtprog/info/faq_securityfixes.htm
secunia	www.secunia.com/advisories/11846
securityfocus	www.securityfocus.com/bid/10530
securityfocus	www.securityfocus.com/bid/10534
osvdb	www.osvdb.org/6949
exchange	www.exchange.xforce.ibmcloud.com/vulnerabilities/16411
archives	www.archives.neohapsis.com/archives/fulldisclosure/2004-06/0363.html
providesecurity	www.providesecurity.com/research/advisories/06142004-01.asp

Parameter	Position	Path	Description	CWE
cat	query param	vpasp/shopdisplayproducts.asp	Cross-site scripting vulnerability via unsanitized cat parameter in shopdisplayproducts.asp	CWE-79
msg	query param	vpasp/shoperror.asp	Cross-site scripting vulnerability via unsanitized msg parameter in shoperror.asp	CWE-79

16 Jun 2026 22:09Current

6.2Medium risk

Vulners AI Score6.2

CVSS 24.3

EPSS0.02193