CVE-2004-2352: Cross-site scripting (XSS) vulnerability in GBook for PHP-Nuke 1.0 allows remote attackers to inject arbitr...

Security readout for executives and security teams

This is an old cross-site scripting issue in GBook for PHP-Nuke 1.0. A remote attacker could inject web script or HTML through cookie data that the application did not properly cleanse. Business risk mainly applies to legacy public PHP-Nuke sites still running this guestbook module. Exposure is likely limited to legacy PHP-Nuke deployments using GBook for PHP-Nuke 1.0, especially internet-facing guestbook or message pages. The provided affected-product metadata is incomplete, so confirm by asset inventory rather than product names alone. Address this during legacy web-application risk reduction. It is not shown as actively exploited in the supplied sources, but unsupported public PHP-Nuke components can create avoidable customer-session and content-integrity risk. Mitigation focus: Inventory internet-facing PHP-Nuke sites for GBook for PHP-Nuke 1.0.; Disable or remove the GBook module if it is no longer business-critical.; Check vendor or historical advisory guidance for fixed versions or replacements..

Prepared

Jun 29, 2026, 18:40 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.