CVE-2004-2246

Goollery - Cross-Site Scripting via Conversation ID Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2004-2246. PoCs published by Lostmon.

AI-analyzed exploit summary The provided text describes a cross-site scripting (XSS) vulnerability in Goollery, where the 'page' parameter in several scripts fails to sanitize user-supplied input. An example URI is given to demonstrate how an attacker could craft a malicious link to render hostile HTML and script code in a victim's browser.

Description

Cross-site scripting (XSS) vulnerability in Goollery before 0.04b allows remote attackers to inject arbitrary HTML or web script via the conversation_id parameter to viewpic.php.

Exploits (1)

exploitdb WRITEUP VERIFIED
by Lostmon · textwebappsphp
https://www.exploit-db.com/exploits/24718

The provided text describes a cross-site scripting (XSS) vulnerability in Goollery, where the 'page' parameter in several scripts fails to sanitize user-supplied input. An example URI is given to demonstrate how an attacker could craft a malicious link to render hostile HTML and script code in a victim's browser.

Classification
Writeup 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: Goollery (version not specified)
No auth needed
Prerequisites: Victim must click on a malicious link
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (2)

Core 2
Core References
Exploit, Patch vdb-entry x_refsource_osvdb
http://www.osvdb.org/11624

Scores

EPSS 0.0269
EPSS Percentile 83.9%

Details

Status published
Products (1)
goollery/goollery 0.3
Published Dec 31, 2004
Tracked Since Feb 18, 2026