CVE-2004-1822: Phorum

Medium severity, CVSS 4.3. EPSS: 2.5% chance of exploitation in the next 30 days.

Multiple cross-site scripting (XSS) vulnerabilities in Phorum 3.1 through 5.0.3 beta allow remote attackers to inject arbitrary web script or HTML via the (1) HTTP_REFERER parameter to login.php, (2) HTTP_REFERER parameter to register.php, or (3) target parameter to profile.php.

Affected products

• Phorum Phorum: version 3.1 only; version 3.1.1 only; version 3.1.1_pre only; version 3.1.1_rc2 only; version 3.1.1a only; version 3.1.2 only; …

Published 2004-03-15. Last modified 2026-06-16.