Read the docs
TI-2004-02521 Aliases CVE-2004-2651GHSA-cpj4-3r8w-83gx

Multiple cross-site scripting (XSS) vulnerabilities in YaCy before 0.32 allow remote…

Priority LOW 23Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
—
Confidentiality · integrity · availability
None · Partial · None
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

Multiple cross-site scripting (XSS) vulnerabilities in YaCy before 0.32 allow remote attackers to inject arbitrary web script or HTML via the (1) urlmaskfilter parameter to index.html or the (2) page parameter to Wiki.html.

Why it matters now

EPSS 0.01477 74th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 25

CPEVersionsRoleVendor
cpe:2.3:a:michael_christen:yacy:0.1_build2004-01-19:*:*:*:*:*:*:*0.1_build2004-01-19VulnerableMichael Christen
cpe:2.3:a:michael_christen:yacy:0.11_build2004-01-24:*:*:*:*:*:*:*0.11_build2004-01-24VulnerableMichael Christen
cpe:2.3:a:michael_christen:yacy:0.12_build2004-02-04:*:*:*:*:*:*:*0.12_build2004-02-04VulnerableMichael Christen
cpe:2.3:a:michael_christen:yacy:0.13_build2004-02-10:*:*:*:*:*:*:*0.13_build2004-02-10VulnerableMichael Christen
cpe:2.3:a:michael_christen:yacy:0.14_build2004-02-13:*:*:*:*:*:*:*0.14_build2004-02-13VulnerableMichael Christen
cpe:2.3:a:michael_christen:yacy:0.15_build2004-03-18:*:*:*:*:*:*:*0.15_build2004-03-18VulnerableMichael Christen
cpe:2.3:a:michael_christen:yacy:0.16_build2004-05-03:*:*:*:*:*:*:*0.16_build2004-05-03VulnerableMichael Christen
cpe:2.3:a:michael_christen:yacy:0.20_build2004-06-14:*:*:*:*:*:*:*0.20_build2004-06-14VulnerableMichael Christen
cpe:2.3:a:michael_christen:yacy:0.21_build2004-06-27:*:*:*:*:*:*:*0.21_build2004-06-27VulnerableMichael Christen
cpe:2.3:a:michael_christen:yacy:0.22_build2004-07-11:*:*:*:*:*:*:*0.22_build2004-07-11VulnerableMichael Christen
  • cpe:2.3:a:michael_christen:yacy:0.1_build2004-01-19:*:*:*:*:*:*:* Versions 0.1_build2004-01-19 Vulnerable ·Michael Christen
  • cpe:2.3:a:michael_christen:yacy:0.11_build2004-01-24:*:*:*:*:*:*:* Versions 0.11_build2004-01-24 Vulnerable ·Michael Christen
  • cpe:2.3:a:michael_christen:yacy:0.12_build2004-02-04:*:*:*:*:*:*:* Versions 0.12_build2004-02-04 Vulnerable ·Michael Christen
  • cpe:2.3:a:michael_christen:yacy:0.13_build2004-02-10:*:*:*:*:*:*:* Versions 0.13_build2004-02-10 Vulnerable ·Michael Christen
  • cpe:2.3:a:michael_christen:yacy:0.14_build2004-02-13:*:*:*:*:*:*:* Versions 0.14_build2004-02-13 Vulnerable ·Michael Christen
  • cpe:2.3:a:michael_christen:yacy:0.15_build2004-03-18:*:*:*:*:*:*:* Versions 0.15_build2004-03-18 Vulnerable ·Michael Christen
  • cpe:2.3:a:michael_christen:yacy:0.16_build2004-05-03:*:*:*:*:*:*:* Versions 0.16_build2004-05-03 Vulnerable ·Michael Christen
  • cpe:2.3:a:michael_christen:yacy:0.20_build2004-06-14:*:*:*:*:*:*:* Versions 0.20_build2004-06-14 Vulnerable ·Michael Christen
  • cpe:2.3:a:michael_christen:yacy:0.21_build2004-06-27:*:*:*:*:*:*:* Versions 0.21_build2004-06-27 Vulnerable ·Michael Christen
  • cpe:2.3:a:michael_christen:yacy:0.22_build2004-07-11:*:*:*:*:*:*:* Versions 0.22_build2004-07-11 Vulnerable ·Michael Christen
Show 15 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:michael_christen:yacy:0.23_build2004-08-08:*:*:*:*:*:*:*0.23_build2004-08-08VulnerableMichael Christen
cpe:2.3:a:michael_christen:yacy:0.24_build2004-08-16:*:*:*:*:*:*:*0.24_build2004-08-16VulnerableMichael Christen
cpe:2.3:a:michael_christen:yacy:0.25_build2004-08-22:*:*:*:*:*:*:*0.25_build2004-08-22VulnerableMichael Christen
cpe:2.3:a:michael_christen:yacy:0.26_build2004-09-16:*:*:*:*:*:*:*0.26_build2004-09-16VulnerableMichael Christen
cpe:2.3:a:michael_christen:yacy:0.27_build2004-09-24:*:*:*:*:*:*:*0.27_build2004-09-24VulnerableMichael Christen
cpe:2.3:a:michael_christen:yacy:0.28_build2004-10-01:*:*:*:*:*:*:*0.28_build2004-10-01VulnerableMichael Christen
cpe:2.3:a:michael_christen:yacy:0.29_build2004-10-22:*:*:*:*:*:*:*0.29_build2004-10-22VulnerableMichael Christen
cpe:2.3:a:michael_christen:yacy:0.30_build2004-11-25:*:*:*:*:*:*:*0.30_build2004-11-25VulnerableMichael Christen
cpe:2.3:a:michael_christen:yacy:0.31_build2004-12-09:*:*:*:*:*:*:*0.31_build2004-12-09VulnerableMichael Christen
cpe:2.3:a:michael_christen:yacy:build2003-12-15:*:*:*:*:*:*:*build2003-12-15VulnerableMichael Christen
cpe:2.3:a:michael_christen:yacy:build2003-12-18:*:*:*:*:*:*:*build2003-12-18VulnerableMichael Christen
cpe:2.3:a:michael_christen:yacy:build2003-12-29:*:*:*:*:*:*:*build2003-12-29VulnerableMichael Christen
cpe:2.3:a:michael_christen:yacy:build2004-01-05:*:*:*:*:*:*:*build2004-01-05VulnerableMichael Christen
cpe:2.3:a:michael_christen:yacy:build2004-01-07:*:*:*:*:*:*:*build2004-01-07VulnerableMichael Christen
cpe:2.3:a:michael_christen:yacy:build2004-01-10:*:*:*:*:*:*:*build2004-01-10VulnerableMichael Christen
  • cpe:2.3:a:michael_christen:yacy:0.23_build2004-08-08:*:*:*:*:*:*:* Versions 0.23_build2004-08-08 Vulnerable ·Michael Christen
  • cpe:2.3:a:michael_christen:yacy:0.24_build2004-08-16:*:*:*:*:*:*:* Versions 0.24_build2004-08-16 Vulnerable ·Michael Christen
  • cpe:2.3:a:michael_christen:yacy:0.25_build2004-08-22:*:*:*:*:*:*:* Versions 0.25_build2004-08-22 Vulnerable ·Michael Christen
  • cpe:2.3:a:michael_christen:yacy:0.26_build2004-09-16:*:*:*:*:*:*:* Versions 0.26_build2004-09-16 Vulnerable ·Michael Christen
  • cpe:2.3:a:michael_christen:yacy:0.27_build2004-09-24:*:*:*:*:*:*:* Versions 0.27_build2004-09-24 Vulnerable ·Michael Christen
  • cpe:2.3:a:michael_christen:yacy:0.28_build2004-10-01:*:*:*:*:*:*:* Versions 0.28_build2004-10-01 Vulnerable ·Michael Christen
  • cpe:2.3:a:michael_christen:yacy:0.29_build2004-10-22:*:*:*:*:*:*:* Versions 0.29_build2004-10-22 Vulnerable ·Michael Christen
  • cpe:2.3:a:michael_christen:yacy:0.30_build2004-11-25:*:*:*:*:*:*:* Versions 0.30_build2004-11-25 Vulnerable ·Michael Christen
  • cpe:2.3:a:michael_christen:yacy:0.31_build2004-12-09:*:*:*:*:*:*:* Versions 0.31_build2004-12-09 Vulnerable ·Michael Christen
  • cpe:2.3:a:michael_christen:yacy:build2003-12-15:*:*:*:*:*:*:* Versions build2003-12-15 Vulnerable ·Michael Christen
  • cpe:2.3:a:michael_christen:yacy:build2003-12-18:*:*:*:*:*:*:* Versions build2003-12-18 Vulnerable ·Michael Christen
  • cpe:2.3:a:michael_christen:yacy:build2003-12-29:*:*:*:*:*:*:* Versions build2003-12-29 Vulnerable ·Michael Christen
  • cpe:2.3:a:michael_christen:yacy:build2004-01-05:*:*:*:*:*:*:* Versions build2004-01-05 Vulnerable ·Michael Christen
  • cpe:2.3:a:michael_christen:yacy:build2004-01-07:*:*:*:*:*:*:* Versions build2004-01-07 Vulnerable ·Michael Christen
  • cpe:2.3:a:michael_christen:yacy:build2004-01-10:*:*:*:*:*:*:* Versions build2004-01-10 Vulnerable ·Michael Christen

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2004-2651
  2. 2026-10-03 Alias added: GHSA-cpj4-3r8w-83gx

References

Exploit 2

Other 2

  • TI-2008-04514 Multiple unspecified vulnerabilities in YaCy before 0.61 have unknown impact and attack vectors. CVSS 2.0HIGH 10.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences