CVE-2004-2245: Cross-site scripting (XSS) vulnerability in Goollery 0.03 allows remote attackers to inject arbitrary HTML...

Security readout for executives and security teams

Goollery 0.03 has a cross-site scripting flaw that could let a remote attacker make the site return attacker-controlled HTML or script through specific page parameters. The sources do not provide a CVSS score, confirmed exploitation, or a vendor fix, so urgency depends on whether this old application is still deployed and reachable. Exposure is likely limited to organizations still running Goollery 0.03, especially if viewalbum.php or viewpic.php are internet-accessible. The source bundle lists affected product metadata as n/a, so inventory confirmation is required before assuming impact. Treat as a targeted legacy-web risk. Prioritize confirmation and retirement if Goollery 0.03 is externally reachable. If not present, record as not applicable. The lack of severity scoring and exploitation evidence lowers immediate urgency but does not remove browser-side risk. Mitigation focus: Inventory for Goollery 0.03 installations and public exposure.; Check vendor or archived project guidance for any fixed release.; Retire or replace unsupported Goollery deployments where practical..

Prepared

Jun 29, 2026, 19:05 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.