Phorum · Phorum · CVE-2004-0034
**Name of the Vulnerable Software and Affected Versions**
Phorum versions 3.4.5 and earlier
**Description**
The issue allows remote attackers to inject arbitrary HTML or web script. This is achieved through multiple vectors, including the `phorum check xss` function in common.php, the `EditError` variable in profile.php, and the `Error` variable in login.php.
**Recommendations**
For Phorum versions 3.4.5 and earlier, consider disabling the `phorum check xss` function in common.php, restricting access to the `EditError` variable in profile.php, and limiting the use of the `Error` variable in login.php until a fix is available.