{"api_version":"1","generated_at":"2026-07-23T08:43:13+00:00","cve":"CVE-2004-1875","urls":{"html":"https://cve.report/CVE-2004-1875","api":"https://cve.report/api/cve/CVE-2004-1875.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2004-1875","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2004-1875"},"summary":{"title":"CVE-2004-1875","description":"Multiple cross-site scripting (XSS) vulnerabilities in cPanel 9.1.0-R85 allow remote attackers to inject arbitrary web script or HTML via the (1) email parameter to testfile.html, (2) file parameter to erredit.html, (3) dns parameter to dnslook.html, (4) account parameter to ignorelist.html, (5) account parameter to showlog.html, (6) db parameter to repairdb.html, (7) login parameter to doaddftp.html (8) account parameter to editmsg.htm, or (9) ip parameter to del.html.  NOTE: the dnslook.html vector was later reported to exist in cPanel 10.","state":"PUBLISHED","assigner":"mitre","published_at":"2004-03-30 05:00:00","updated_at":"2025-04-03 01:03:51"},"problem_types":["CWE-79","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"9.3","severity":"","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:C/I:C/A:C","baseScore":9.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"}}],"references":[{"url":"http://www.osvdb.org/4210","name":"http://www.osvdb.org/4210","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/15671","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/15671","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.vupen.com/english/advisories/2006/4658","name":"http://www.vupen.com/english/advisories/2006/4658","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.osvdb.org/4208","name":"http://www.osvdb.org/4208","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://secunia.com/advisories/11244","name":"http://secunia.com/advisories/11244","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"title":"Secunia - Advisories - cPanel Multiple Cross-Site Scripting Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.osvdb.org/4212","name":"http://www.osvdb.org/4212","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.cirt.net/advisories/cpanel_xss.shtml","name":"http://www.cirt.net/advisories/cpanel_xss.shtml","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"title":"cPanel Cross Site Scripting (XSS)","mime":"text/html","httpstatus":"404","archivestatus":"200"},{"url":"http://www.osvdb.org/4214","name":"http://www.osvdb.org/4214","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.aria-security.com/forum/showthread.php?t=30","name":"http://www.aria-security.com/forum/showthread.php?t=30","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"text/plain","httpstatus":"500","archivestatus":"404"},{"url":"http://www.osvdb.org/4243","name":"http://www.osvdb.org/4243","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://marc.info/?l=bugtraq&m=108066561608676&w=2","name":"http://marc.info/?l=bugtraq&m=108066561608676&w=2","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"'Exensive cPanel Cross Site Scripting' - MARC","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/22984","name":"http://secunia.com/advisories/22984","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"cPanel \"dns\" Cross-Site Scripting Vulnerability - Advisories - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.osvdb.org/4215","name":"http://www.osvdb.org/4215","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.osvdb.org/4213","name":"http://www.osvdb.org/4213","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.securityfocus.com/bid/10002","name":"http://www.securityfocus.com/bid/10002","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"cPanel Multiple Module Cross-Site Scripting Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://www.osvdb.org/4209","name":"http://www.osvdb.org/4209","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.osvdb.org/4211","name":"http://www.osvdb.org/4211","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.securityfocus.com/bid/21142","name":"http://www.securityfocus.com/bid/21142","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"CPanel DNSlook.HTML Cross-Site Scripting Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2004-1875","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2004-1875","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2004","cve_id":"1875","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cpanel","cpe5":"cpanel","cpe6":"9.1.0_r85","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-08T01:07:48.792Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"4243","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://www.osvdb.org/4243"},{"name":"20040330 Exensive cPanel Cross Site Scripting","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://marc.info/?l=bugtraq&m=108066561608676&w=2"},{"name":"21142","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/21142"},{"name":"11244","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/11244"},{"name":"4215","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://www.osvdb.org/4215"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://www.cirt.net/advisories/cpanel_xss.shtml"},{"name":"4210","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://www.osvdb.org/4210"},{"name":"cpanel-multiple-scripts-xss(15671)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/15671"},{"name":"22984","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/22984"},{"name":"4211","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://www.osvdb.org/4211"},{"name":"ADV-2006-4658","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2006/4658"},{"name":"10002","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/10002"},{"name":"4212","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://www.osvdb.org/4212"},{"name":"4208","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://www.osvdb.org/4208"},{"name":"4213","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://www.osvdb.org/4213"},{"name":"4214","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://www.osvdb.org/4214"},{"name":"4209","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://www.osvdb.org/4209"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://www.aria-security.com/forum/showthread.php?t=30"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2004-03-30T00:00:00.000Z","descriptions":[{"lang":"en","value":"Multiple cross-site scripting (XSS) vulnerabilities in cPanel 9.1.0-R85 allow remote attackers to inject arbitrary web script or HTML via the (1) email parameter to testfile.html, (2) file parameter to erredit.html, (3) dns parameter to dnslook.html, (4) account parameter to ignorelist.html, (5) account parameter to showlog.html, (6) db parameter to repairdb.html, (7) login parameter to doaddftp.html (8) account parameter to editmsg.htm, or (9) ip parameter to del.html.  NOTE: the dnslook.html vector was later reported to exist in cPanel 10."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-07-10T14:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"4243","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://www.osvdb.org/4243"},{"name":"20040330 Exensive cPanel Cross Site Scripting","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://marc.info/?l=bugtraq&m=108066561608676&w=2"},{"name":"21142","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/21142"},{"name":"11244","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/11244"},{"name":"4215","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://www.osvdb.org/4215"},{"tags":["x_refsource_MISC"],"url":"http://www.cirt.net/advisories/cpanel_xss.shtml"},{"name":"4210","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://www.osvdb.org/4210"},{"name":"cpanel-multiple-scripts-xss(15671)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/15671"},{"name":"22984","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/22984"},{"name":"4211","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://www.osvdb.org/4211"},{"name":"ADV-2006-4658","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2006/4658"},{"name":"10002","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/10002"},{"name":"4212","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://www.osvdb.org/4212"},{"name":"4208","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://www.osvdb.org/4208"},{"name":"4213","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://www.osvdb.org/4213"},{"name":"4214","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://www.osvdb.org/4214"},{"name":"4209","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://www.osvdb.org/4209"},{"tags":["x_refsource_MISC"],"url":"http://www.aria-security.com/forum/showthread.php?t=30"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2004-1875","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple cross-site scripting (XSS) vulnerabilities in cPanel 9.1.0-R85 allow remote attackers to inject arbitrary web script or HTML via the (1) email parameter to testfile.html, (2) file parameter to erredit.html, (3) dns parameter to dnslook.html, (4) account parameter to ignorelist.html, (5) account parameter to showlog.html, (6) db parameter to repairdb.html, (7) login parameter to doaddftp.html (8) account parameter to editmsg.htm, or (9) ip parameter to del.html.  NOTE: the dnslook.html vector was later reported to exist in cPanel 10."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"4243","refsource":"OSVDB","url":"http://www.osvdb.org/4243"},{"name":"20040330 Exensive cPanel Cross Site Scripting","refsource":"BUGTRAQ","url":"http://marc.info/?l=bugtraq&m=108066561608676&w=2"},{"name":"21142","refsource":"BID","url":"http://www.securityfocus.com/bid/21142"},{"name":"11244","refsource":"SECUNIA","url":"http://secunia.com/advisories/11244"},{"name":"4215","refsource":"OSVDB","url":"http://www.osvdb.org/4215"},{"name":"http://www.cirt.net/advisories/cpanel_xss.shtml","refsource":"MISC","url":"http://www.cirt.net/advisories/cpanel_xss.shtml"},{"name":"4210","refsource":"OSVDB","url":"http://www.osvdb.org/4210"},{"name":"cpanel-multiple-scripts-xss(15671)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/15671"},{"name":"22984","refsource":"SECUNIA","url":"http://secunia.com/advisories/22984"},{"name":"4211","refsource":"OSVDB","url":"http://www.osvdb.org/4211"},{"name":"ADV-2006-4658","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2006/4658"},{"name":"10002","refsource":"BID","url":"http://www.securityfocus.com/bid/10002"},{"name":"4212","refsource":"OSVDB","url":"http://www.osvdb.org/4212"},{"name":"4208","refsource":"OSVDB","url":"http://www.osvdb.org/4208"},{"name":"4213","refsource":"OSVDB","url":"http://www.osvdb.org/4213"},{"name":"4214","refsource":"OSVDB","url":"http://www.osvdb.org/4214"},{"name":"4209","refsource":"OSVDB","url":"http://www.osvdb.org/4209"},{"name":"http://www.aria-security.com/forum/showthread.php?t=30","refsource":"MISC","url":"http://www.aria-security.com/forum/showthread.php?t=30"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2004-1875","datePublished":"2005-05-10T04:00:00.000Z","dateReserved":"2005-05-04T00:00:00.000Z","dateUpdated":"2024-08-08T01:07:48.792Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2004-03-30 05:00:00","lastModifiedDate":"2025-04-03 01:03:51","problem_types":["CWE-79","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:C/I:C/A:C","baseScore":9.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":8.6,"impactScore":10,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:cpanel:cpanel:9.1.0_r85:*:*:*:*:*:*:*","matchCriteriaId":"4D9DDCBE-8A9C-44FC-8A24-47933CE057F2"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2004","CveId":"1875","Ordinal":"1","Title":"CVE-2004-1875","CVE":"CVE-2004-1875","Year":"2004"},"notes":[{"CveYear":"2004","CveId":"1875","Ordinal":"1","NoteData":"Multiple cross-site scripting (XSS) vulnerabilities in cPanel 9.1.0-R85 allow remote attackers to inject arbitrary web script or HTML via the (1) email parameter to testfile.html, (2) file parameter to erredit.html, (3) dns parameter to dnslook.html, (4) account parameter to ignorelist.html, (5) account parameter to showlog.html, (6) db parameter to repairdb.html, (7) login parameter to doaddftp.html (8) account parameter to editmsg.htm, or (9) ip parameter to del.html.  NOTE: the dnslook.html vector was later reported to exist in cPanel 10.","Type":"Description","Title":"CVE-2004-1875"},{"CveYear":"2004","CveId":"1875","Ordinal":"2","NoteData":"2005-05-10","Type":"Other","Title":"Published"},{"CveYear":"2004","CveId":"1875","Ordinal":"3","NoteData":"2017-07-10","Type":"Other","Title":"Modified"}]}}}