Unscored severity · published Dec 31, 2004
CVE-2004-2585
Cross-site scripting (XSS) vulnerability in frmCompose.aspx in SmarterTools SmarterMail 1.6.1511 and 1.6.1529 allows remote attackers to inject arbitrary web script or HTML via…
–
CVSS
1.4%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in frmCompose.aspx in SmarterTools SmarterMail 1.6.1511 and 1.6.1529 allows remote attackers to inject arbitrary web script or HTML via Javascript to the "check spelling" feature in the compose area.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 73% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SM
Smartermail · Smartertools
1.6.1511; 1.6.1529 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2004-2585
CVE.org
https://www.cve.org/CVERecord?id=CVE-2004-2585
members.lycos.co.uk
http://members.lycos.co.uk/r34ct/main/smarter_mail%203.1/smarter_mail.txt
Vendor Advisory
http://secunia.com/advisories/11042
securitytracker.com
http://securitytracker.com/id?1009307
www.osvdb.org
http://www.osvdb.org/4145
www.securityfocus.com
http://www.securityfocus.com/bid/9805
Exploit
http://www.zone-h.org/advisories/read/id=4098
More from Smartermail
10.0
CVE-2025-52691
Upload Arbitrary Files
9.8
CVE-2026-24423
SmarterTools SmarterMail < Build 9511 Unauthenticated RCE via ConnectToHub API
9.8
CVE-2026-23760
SmarterTools SmarterMail < Build 9511 Authentication Bypass via Password Reset API
9.8
CVE-2021-32234
SmarterTools SmarterMail 16.x through 100.x before 100.0.7803 allows remote code execution
9.8
CVE-2019-7214
SmarterTools SmarterMail 16.x before build 6985 allows deserialization of untrusted data