CVE-2004-1640: Multiple cross-site scripting (XSS) vulnerabilities in XOOPS 0.94 and 1.0 allow remote attackers to execute...

Security readout for executives and security teams

This is a legacy XOOPS cross-site scripting issue. A vulnerable site could reflect attacker-supplied web content back to a visitor, letting script run in that visitor's browser context. Business risk depends on whether old XOOPS pages remain public and authenticated users visit crafted links. Likely limited to organizations still running XOOPS 0.94/1.0 or the referenced XOOPS Dictionary module endpoints exposed to users. Asset inventories may miss it because affected metadata is sparse and some references point to dictionary module records rather than clean product CPEs. Treat this as a targeted legacy exposure cleanup, not a crisis, unless old XOOPS systems are internet-facing or used by privileged staff. Prioritize inventory confirmation and replacement because affected software is very old and source data is incomplete. Mitigation focus: Identify and retire exposed XOOPS 0.94 or 1.0 deployments.; Check XOOPS vendor or project guidance for fixed versions.; Disable or restrict affected dictionary/search pages if still deployed..

Prepared

Jun 30, 2026, 00:10 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.