CVE-2004-2509: Ubbcentral Ubb.threads

Medium severity, CVSS 4.3. EPSS: 2.2% chance of exploitation in the next 30 days.

Cross-site scripting (XSS) vulnerabilities in (1) calendar.php, (2) login.php, and (3) online.php in Infopop UBB.Threads 6.2.3 and 6.5 allow remote attackers to inject arbitrary web script or HTML via the Cat parameter.

Affected products

• Ubbcentral Ubb.threads: version 6.2.3 only; version 6.5 only

Published 2004-12-31. Last modified 2026-06-16.