CVE-2004-1202: Cross-site scripting (XSS) vulnerability in parser.php in phpCMS 1.2.1 and earlier, with non-stealth and de...

Security readout for executives and security teams

CVE-2004-1202 is a legacy cross-site scripting issue in phpCMS 1.2.1 and earlier. If specific debug and non-stealth modes are enabled, a remote attacker may cause a victim’s browser to run injected script through parser.php. The main business risk is compromise of user sessions or trust in an exposed legacy site. Exposure is most likely on old phpCMS installations, especially internet-facing sites still running version 1.2.1 or earlier with parser.php reachable and debug plus non-stealth modes enabled. Treat this as a legacy exposure cleanup item, not an emergency unless the affected CMS is internet-facing or handles authenticated users. Unsupported CMS software with XSS risk should be removed or isolated because remediation evidence is incomplete. Mitigation focus: Identify and retire phpCMS 1.2.1 or earlier deployments.; Disable debug and non-stealth modes where they are not operationally required.; Restrict public access to legacy parser.php if the site cannot be upgraded quickly..

Prepared

Jun 30, 2026, 01:53 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.