CVE-2004-0271: Maxwebportal

Medium severity, CVSS 6.8. EPSS: 2.1% chance of exploitation in the next 30 days.

Multiple cross-site scripting vulnerabilities (XSS) in MaxWebPortal allow remote attackers to execute arbitrary web script as other users via (1) the sub_name parameter of dl_showall.asp, (2) the SendTo parameter in Personal Messages, (3) the HTTP_REFERER for down.asp, or (4) the image name of an Avatar in the register form.

Affected products

• Maxwebportal Maxwebportal: version 1.30 only; version 1.31 only

Published 2004-11-23. Last modified 2026-06-16.