{"api_version":"1","generated_at":"2026-07-23T06:21:52+00:00","cve":"CVE-2004-2725","urls":{"html":"https://cve.report/CVE-2004-2725","api":"https://cve.report/api/cve/CVE-2004-2725.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2004-2725","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2004-2725"},"summary":{"title":"CVE-2004-2725","description":"Multiple cross-site scripting (XSS) vulnerabilities in Aztek Forum 4.0 allow remote attackers to inject arbitrary web script or HTML via (1) the search parameter in (a) search.php, (2) the email parameter in (b) subscribe.php, and (3) the return and (4) title parameters in (c) forum_2.php.","state":"PUBLISHED","assigner":"mitre","published_at":"2004-12-31 05:00:00","updated_at":"2025-04-03 01:03:51"},"problem_types":["CWE-79","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"http://secunia.com/advisories/13202","name":"http://secunia.com/advisories/13202","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Secunia - Advisories - Aztek Forum Cross-Site Scripting Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/18057","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/18057","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.osvdb.org/11705","name":"http://www.osvdb.org/11705","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://securitytracker.com/id?1012213","name":"http://securitytracker.com/id?1012213","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"Aztek Forum Input Validation Holes Lets Remote Users Conduct Cross-Site Scripting Attacks - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.osvdb.org/11706","name":"http://www.osvdb.org/11706","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.osvdb.org/11704","name":"http://www.osvdb.org/11704","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.securityfocus.com/bid/11654","name":"http://www.securityfocus.com/bid/11654","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"Aztek Forum Multiple Input Validation Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2004-2725","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2004-2725","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2004","cve_id":"2725","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"aztek_forum","cpe5":"aztek_forum","cpe6":"4.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-08T01:36:25.301Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"11706","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://www.osvdb.org/11706"},{"name":"11654","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/11654"},{"name":"11705","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://www.osvdb.org/11705"},{"name":"13202","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/13202"},{"name":"11704","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://www.osvdb.org/11704"},{"name":"aztek-forum-xss(18057)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/18057"},{"name":"1012213","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://securitytracker.com/id?1012213"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2004-11-12T00:00:00.000Z","descriptions":[{"lang":"en","value":"Multiple cross-site scripting (XSS) vulnerabilities in Aztek Forum 4.0 allow remote attackers to inject arbitrary web script or HTML via (1) the search parameter in (a) search.php, (2) the email parameter in (b) subscribe.php, and (3) the return and (4) title parameters in (c) forum_2.php."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-07-28T12:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"11706","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://www.osvdb.org/11706"},{"name":"11654","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/11654"},{"name":"11705","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://www.osvdb.org/11705"},{"name":"13202","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/13202"},{"name":"11704","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://www.osvdb.org/11704"},{"name":"aztek-forum-xss(18057)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/18057"},{"name":"1012213","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://securitytracker.com/id?1012213"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2004-2725","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple cross-site scripting (XSS) vulnerabilities in Aztek Forum 4.0 allow remote attackers to inject arbitrary web script or HTML via (1) the search parameter in (a) search.php, (2) the email parameter in (b) subscribe.php, and (3) the return and (4) title parameters in (c) forum_2.php."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"11706","refsource":"OSVDB","url":"http://www.osvdb.org/11706"},{"name":"11654","refsource":"BID","url":"http://www.securityfocus.com/bid/11654"},{"name":"11705","refsource":"OSVDB","url":"http://www.osvdb.org/11705"},{"name":"13202","refsource":"SECUNIA","url":"http://secunia.com/advisories/13202"},{"name":"11704","refsource":"OSVDB","url":"http://www.osvdb.org/11704"},{"name":"aztek-forum-xss(18057)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/18057"},{"name":"1012213","refsource":"SECTRACK","url":"http://securitytracker.com/id?1012213"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2004-2725","datePublished":"2007-10-06T21:00:00.000Z","dateReserved":"2007-10-06T00:00:00.000Z","dateUpdated":"2024-08-08T01:36:25.301Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2004-12-31 05:00:00","lastModifiedDate":"2025-04-03 01:03:51","problem_types":["CWE-79","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:aztek_forum:aztek_forum:4.0:*:*:*:*:*:*:*","matchCriteriaId":"BEF91FDD-2582-4E67-BAA6-4B4EA4114E02"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2004","CveId":"2725","Ordinal":"1","Title":"CVE-2004-2725","CVE":"CVE-2004-2725","Year":"2004"},"notes":[{"CveYear":"2004","CveId":"2725","Ordinal":"1","NoteData":"Multiple cross-site scripting (XSS) vulnerabilities in Aztek Forum 4.0 allow remote attackers to inject arbitrary web script or HTML via (1) the search parameter in (a) search.php, (2) the email parameter in (b) subscribe.php, and (3) the return and (4) title parameters in (c) forum_2.php.","Type":"Description","Title":"CVE-2004-2725"},{"CveYear":"2004","CveId":"2725","Ordinal":"2","NoteData":"2007-10-06","Type":"Other","Title":"Published"},{"CveYear":"2004","CveId":"2725","Ordinal":"3","NoteData":"2017-07-28","Type":"Other","Title":"Modified"}]}}}