CVE-2004-2494

Ability Mail Server 1.18 - Cross-Site Scripting via erromsg Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2004-2494. PoCs published by dr_insane.

AI-analyzed exploit summary The provided text describes two vulnerabilities in Ability Mail Server 1.18: a cross-site scripting (XSS) vulnerability and a denial of service (DoS) vulnerability. The XSS can be triggered via a crafted URL, while the DoS requires establishing multiple connections to various services.

Description

Cross-site scripting (XSS) vulnerability in _error in Ability Mail Server 1.18 allows remote attackers to inject arbitrary web script or HTML via the erromsg parameter.

Exploits (1)

exploitdb WRITEUP VERIFIED

by dr_insane · textremotemultiple

https://www.exploit-db.com/exploits/24268

View Code ZIP pw:eip

The provided text describes two vulnerabilities in Ability Mail Server 1.18: a cross-site scripting (XSS) vulnerability and a denial of service (DoS) vulnerability. The XSS can be triggered via a crafted URL, while the DoS requires establishing multiple connections to various services.

Classification

Writeup 90%

Attack Type

Xss | Dos

Complexity

Trivial

Reliability

Theoretical

Target: Ability Mail Server 1.18

No auth needed

Prerequisites: Network access to the target server · Ability to send crafted HTTP requests for XSS · Ability to establish multiple connections for DoS

MITRE ATT&CK

T1059.007 - JavaScript T1499 - Endpoint Denial of Service

devstral-2 · analyzed Feb 16, 2026 Full analysis →