CVE-2004-2651: Multiple cross-site scripting (XSS) vulnerabilities in YaCy before 0.32 allow remote attackers to inject ar...

Security readout for executives and security teams

CVE-2004-2651 is an old cross-site scripting issue in YaCy before version 0.32. A remote attacker could inject script or HTML through specific web parameters. Business urgency depends on whether any legacy YaCy instance is still running and reachable by users or the internet. Exposure is likely limited to organizations still running YaCy versions earlier than 0.32, especially if the web interface is reachable by untrusted users or the internet. Treat this as a legacy exposure cleanup item unless YaCy is internet-facing or used by privileged staff. Prioritize discovery first because the CVE is old and severity data is incomplete. Mitigation focus: Inventory all YaCy deployments and identify versions older than 0.32.; Upgrade affected YaCy instances to 0.32 or later after checking vendor guidance.; Restrict access to YaCy web interfaces to trusted networks or authenticated users..

Prepared

Jun 29, 2026, 15:49 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.