CVE-2004-2484: Cross-site scripting (XSS) vulnerability in PHP Gift Registry 1.3.5 and earlier allows remote attackers to...

Security readout for executives and security teams

CVE-2004-2484 is a cross-site scripting issue in PHP Gift Registry 1.3.5 and earlier. An attacker could inject script or HTML through the message parameter in event.php or index.php. Business risk is mainly to users of any still-exposed legacy registry site, where browser-side abuse could affect trust, sessions, or displayed content. Exposure is likely limited to organizations still running PHP Gift Registry 1.3.5 or earlier on a reachable web server. The product appears legacy, so discovery should focus on old PHP applications, archived webroots, and externally exposed registry pages. Treat this as a targeted legacy exposure issue, not a broad emergency. Prioritize quickly if PHP Gift Registry is internet-facing, used by authenticated users, or hosted on a domain where user trust matters. Mitigation focus: Inventory public and internal sites for PHP Gift Registry deployments.; Verify whether any instance is version 1.3.5 or earlier.; Check SourceForge release notes and vendor history for fixed versions..

Prepared

Jun 29, 2026, 17:30 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.