CVE-2004-2548

published 2004-12-31

CVE-2004-2548: Multiple cross-site scripting (XSS) vulnerabilities in NetWin (1) SurgeMail before 2.0c and (2) WebMail allow remote attackers to inject arbitrary web script…

Priority P4 18 medium 4.3 CVSS 2.0

AV N AC M Au N C N I P A N

EXPLOIT

Multiple cross-site scripting (XSS) vulnerabilities in NetWin (1) SurgeMail before 2.0c and (2) WebMail allow remote attackers to inject arbitrary web script or HTML via (a) a URI containing the script, or (b) the username field in the login form. NOTE: it is possible that the first attack vector is resultant from the error message issue (CVE-2004-2547).

Affected

9 ranges

Vendor	Product	Version range	Fixed in
netwin	surgemail	<= 2.0a2	—
netwin	surgemail	—	—
netwin	surgemail	—	—
netwin	surgemail	—	—
netwin	surgemail	—	—
netwin	surgemail	—	—
netwin	surgemail	—	—
netwin	surgemail	—	—
netwin	webmail	—	—

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.