CVE-2004-2109: Quadcomm Q-Shop

Medium severity, CVSS 6.8. EPSS: 2.2% chance of exploitation in the next 30 days.

Multiple cross-site scripting (XSS) vulnerabilities in (1) imagezoom.asp or (2) recommend.asp in Q-Shop allow remote attackers to execute arbitrary script and steal the user session ID via Javascript in a URL.

Affected products

• Quadcomm Q-Shop: version 2.0 only; version 2.1 only; version 2.5 only; version 2.5_beta only

Published 2004-12-31. Last modified 2026-06-16.