Unrated severityNVD Advisory· Published Dec 31, 2004· Updated Jun 16, 2026
CVE-2004-2411
CVE-2004-2411
Description
The CleanseMessage function in shop$db.asp for VP-ASP Shopping Cart 4.0 through 5.0 does not sufficiently cleanse inputs, which allows remote attackers to conduct cross-site scripting (XSS) attacks that do not use tags, as demonstrated via javascript in IMG tags to (1) the cat parameter in shopdisplayproducts.asp or (2) the msg parameter in shoperror.asp, and possibly other vectors.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
4cpe:2.3:a:virtual_programming:vp-asp:4.0:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:virtual_programming:vp-asp:4.0:*:*:*:*:*:*:*
- cpe:2.3:a:virtual_programming:vp-asp:4.50:*:*:*:*:*:*:*
- cpe:2.3:a:virtual_programming:vp-asp:5.0:*:*:*:*:*:*:*
- Range: >=4.0, <=5.0
Patches
Vulnerability mechanics
References
8- www.securityfocus.com/bid/10530nvdPatch
- www.vpasp.com/virtprog/info/faq_securityfixes.htmnvdPatch
- archives.neohapsis.com/archives/fulldisclosure/2004-06/0363.htmlnvdExploitPatchVendor Advisory
- www.providesecurity.com/research/advisories/06142004-01.aspnvdExploitPatchVendor Advisory
- www.securityfocus.com/bid/10534nvdExploitPatch
- secunia.com/advisories/11846nvdVendor Advisory
- www.osvdb.org/6949nvd
- exchange.xforce.ibmcloud.com/vulnerabilities/16411nvd
News mentions
0No linked articles in our index yet.