Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.8

Gallery 1.4.4-pl3 allows attackers to run malicious scripts

CVE-2004-1106 · published 21 years ago
Summary

The Gallery web application (versions up to 1.4.4-pl3) can be tricked into running code supplied in a specially crafted web address. An attacker could use this to display unwanted content, steal user credentials, or hijack a user session. Protect your site by installing the latest Gallery update or applying the vendor's recommended input‑validation patch.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
gallery_project gallery 1.4
1.4.1
1.4.2
1.4.3_pl1
1.4.3_pl2
1.4_pl1
1.4_pl2
cpe:2.3:a:gallery_project:gallery:1.4:*:*:*:*:*:*:*
gentoo linux All versions
cpe:2.3:o:gentoo:linux:*:*:*:*:*:*:*:*
Original advisory text
Cross-site scripting (XSS) vulnerability in Gallery 1.4.4-pl3 and earlier allows remote attackers to execute arbitrary web script or HTML via "specially formed URLs," possibly via the include param...
Cross-site scripting (XSS) vulnerability in Gallery 1.4.4-pl3 and earlier allows remote attackers to execute arbitrary web script or HTML via "specially formed URLs," possibly via the include parameter in index.php.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
6.8 Medium
Exploitation
1% chance of attack within 30 days
Timeline
Published10 Jan 2005
Updated31 Oct 2026
First seen29 Sep 2026
Sources
CVE-2004-1106 · NVD
Track software like this
Free during beta