CVE-2004-1875

Multiple cross-site scripting (XSS) vulnerabilities in cPanel 9.1.0-R85 allow remote attackers to inject arbitrary web script or HTML via the (1) email parameter to testfile.html, (2) file parameter to erredit.html, (3) dns parameter to dnslook.html, (4) account parameter to ignorelist.html, (5) account parameter to showlog.html, (6) db parameter to repairdb.html, (7) login parameter to doaddftp.html (8) account parameter to editmsg.htm, or (9) ip parameter to del.html. NOTE: the dnslook.html vector was later reported to exist in cPanel 10.

• CWE-79

• http://marc.info/?l=bugtraq&m=108066561608676&w=2
• http://secunia.com/advisories/11244Patch, Vendor Advisory
• http://secunia.com/advisories/22984Vendor Advisory
• http://www.aria-security.com/forum/showthread.php?t=30
• http://www.cirt.net/advisories/cpanel_xss.shtmlPatch, Vendor Advisory
• http://www.osvdb.org/4208Vendor Advisory
• http://www.osvdb.org/4209Vendor Advisory
• http://www.osvdb.org/4210Vendor Advisory
• http://www.osvdb.org/4211
• http://www.osvdb.org/4212Vendor Advisory
• http://www.osvdb.org/4213Vendor Advisory
• http://www.osvdb.org/4214Vendor Advisory
• http://www.osvdb.org/4215Vendor Advisory
• http://www.osvdb.org/4243Vendor Advisory
• http://www.securityfocus.com/bid/10002Vendor Advisory
• http://www.securityfocus.com/bid/21142
• http://www.vupen.com/english/advisories/2006/4658Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15671
• http://marc.info/?l=bugtraq&m=108066561608676&w=2
• http://secunia.com/advisories/11244Patch, Vendor Advisory
• http://secunia.com/advisories/22984Vendor Advisory
• http://www.aria-security.com/forum/showthread.php?t=30
• http://www.cirt.net/advisories/cpanel_xss.shtmlPatch, Vendor Advisory
• http://www.osvdb.org/4208Vendor Advisory
• http://www.osvdb.org/4209Vendor Advisory
• http://www.osvdb.org/4210Vendor Advisory
• http://www.osvdb.org/4211
• http://www.osvdb.org/4212Vendor Advisory
• http://www.osvdb.org/4213Vendor Advisory
• http://www.osvdb.org/4214Vendor Advisory
• http://www.osvdb.org/4215Vendor Advisory
• http://www.osvdb.org/4243Vendor Advisory
• http://www.securityfocus.com/bid/10002Vendor Advisory
• http://www.securityfocus.com/bid/21142
• http://www.vupen.com/english/advisories/2006/4658Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15671

Published

Mar 30, 2004

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2004-1869Etherlords I 1.07 and earlier and Etherlords II 1.03 and ear…
• CVE-2004-1870Multiple SQL injection vulnerabilities in PhotoPost PHP Pro …
• CVE-2004-1871Multiple cross-site scripting (XSS) vulnerabilities in Photo…
• CVE-2004-1872Cross-site scripting (XSS) vulnerability in WebCT Campus Edi…
• CVE-2004-1873SQL injection vulnerability in category.asp in A-CART Pro an…
• CVE-2004-1874Multiple cross-site scripting (XSS) vulnerabilities in (1) d…
• CVE-2004-1876The "%f" feature in the VirusEvent directive in Clam AntiVir…
• CVE-2004-1877The p_submit_url value in the sample login form in the Oracl…
• CVE-2004-1878LINBOX LIN:BOX allows remote attackers to bypass authenticat…
• CVE-2004-1879Cross-site scripting (XSS) vulnerability in PHPKIT 1.6.03 al…
• CVE-2004-1880Memory leak in the back-bdb backend for OpenLDAP 2.1.12 and …
• CVE-2004-1881SQL injection vulnerability in (1) mailorder.asp or (2) payo…