CVE-2004-2210

CVE-2004-2210 describes multiple cross-site scripting (XSS) vulnerabilities in the Express-Web Content Management System (CMS). Attackers can exploit these flaws by manipulating specific parameters in default.asp and subscribe/default.asp, or by injecting malicious code into the Referer header when accessing login.asp. This vulnerability has a CVSS score of 4.3, indicating a medium attack complexity and potential for partial information disclosure (e.g., stealing cookie-based authentication) without requiring authentication. There is no evidence of active exploitation, publicly available exploit code, or Metasploit/Nuclei modules, though it has garnered some community discussion.