CVE-2004-2656

Multiple cross-site scripting (XSS) vulnerabilities in Slashdot Like Automated Storytelling Homepage (Slash) (aka Slashcode) before R_2_5_0_41 allow remote attackers to inject arbitrary web script or HTML via (1) the topic parameter in search.pl and (2) the filter parameter in submit.pl.

• http://archives.neohapsis.com/archives/bugtraq/2004-12/0170.htmlVendor Advisory
• http://secunia.com/advisories/13491Patch, Vendor Advisory
• http://www.osvdb.org/21874Exploit, Patch
• http://www.osvdb.org/21875Exploit, Patch
• http://www.securityfocus.com/bid/11993Patch
• http://www.slashcode.com/slash/04/12/20/1946225.shtml?tid=11&tid=5&tid=4Patch, Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/18508
• http://archives.neohapsis.com/archives/bugtraq/2004-12/0170.htmlVendor Advisory
• http://secunia.com/advisories/13491Patch, Vendor Advisory
• http://www.osvdb.org/21874Exploit, Patch
• http://www.osvdb.org/21875Exploit, Patch
• http://www.securityfocus.com/bid/11993Patch
• http://www.slashcode.com/slash/04/12/20/1946225.shtml?tid=11&tid=5&tid=4Patch, Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/18508

Published

Dec 31, 2004

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2004-2650Spooler in Apache Foundation James 2.2.0 allows local users …
• CVE-2004-2651Multiple cross-site scripting (XSS) vulnerabilities in YaCy …
• CVE-2004-2652The DecodeTCPOptions function in decode.c in Snort before 2.…
• CVE-2004-2653Unspecified vulnerability in PD9 Software MegaBBS 2.0 and 2.…
• CVE-2004-2654The clientAbortBody function in client_side.c in Squid Web P…
• CVE-2004-2655rdesktop 1.3.1 with xscreensaver 4.14, and possibly other ve…
• CVE-2004-2657Mozilla Firefox 1.5.0.1, and possibly other versions, preser…
• CVE-2004-2658resmgr in SUSE CORE 9 does not properly identify terminal na…
• CVE-2004-2659Opera offers an Open button to verify that a user wishes to …
• CVE-2004-2660Memory leak in direct-io.c in Linux kernel 2.6.x before 2.6.…
• CVE-2004-2661Soft3304 04WebServer before 1.41 does not properly check fil…
• CVE-2004-2662Soft3304 04WebServer before 1.41 allows remote attackers to …