Lucene search

[email protected]CVE-2004-2293

HistoryDec 31, 2004 - 5:00 a.m.

CVE-2004-2293

2004-12-3105:00:00

NVD-CWE-Other

[email protected]

web.nvd.nist.gov

cve-2004-2293

php-nuke

xss

remote attackers

web script

html

encyclopedia module

reviews module

6 Medium

AI Score

Confidence

High

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.047 Low

EPSS

Percentile

92.5%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in PHP-Nuke 6.0 to 7.3 allow remote attackers to inject arbitrary web script or HTML via the (1) eid parameter or (2) query parameter to the Encyclopedia module, (3) preview_review function in the Reviews module as demonstrated by the url, cover, rlanguage, and hits parameters, or (4) savecomment function in the Reviews module, as demonstrated using the uname parameter. NOTE: the Faq/categories and Encyclopedia/ltr issues are already covered by CVE-2005-1023.

CPENameOperatorVersion
francisco_burzi:php-nukefrancisco burzi php-nukeeq6.5_beta1
francisco_burzi:php-nukefrancisco burzi php-nukeeq6.5
francisco_burzi:php-nukefrancisco burzi php-nukeeq7.0
francisco_burzi:php-nukefrancisco burzi php-nukeeq7.2
francisco_burzi:php-nukefrancisco burzi php-nukeeq7.0_final
francisco_burzi:php-nukefrancisco burzi php-nukeeq6.5_rc2
francisco_burzi:php-nukefrancisco burzi php-nukeeq7.3
francisco_burzi:php-nukefrancisco burzi php-nukeeq6.5_rc3
francisco_burzi:php-nukefrancisco burzi php-nukeeq6.0
francisco_burzi:php-nukefrancisco burzi php-nukeeq6.5_final

CPE	Name	Operator	Version
francisco_burzi:php-nuke	francisco burzi php-nuke	eq	6.5_beta1
francisco_burzi:php-nuke	francisco burzi php-nuke	eq	6.5
francisco_burzi:php-nuke	francisco burzi php-nuke	eq	7.0
francisco_burzi:php-nuke	francisco burzi php-nuke	eq	7.2
francisco_burzi:php-nuke	francisco burzi php-nuke	eq	7.0_final
francisco_burzi:php-nuke	francisco burzi php-nuke	eq	6.5_rc2
francisco_burzi:php-nuke	francisco burzi php-nuke	eq	7.3
francisco_burzi:php-nuke	francisco burzi php-nuke	eq	6.5_rc3
francisco_burzi:php-nuke	francisco burzi php-nuke	eq	6.0
francisco_burzi:php-nuke	francisco burzi php-nuke	eq	6.5_final

Rows per page:

1-10 of 151

References

secunia.com/advisories/11852

www.osvdb.org/6997

www.osvdb.org/6998

www.osvdb.org/6999

www.securityfocus.com/archive/1/365865

www.securityfocus.com/bid/10524

exchange.xforce.ibmcloud.com/vulnerabilities/16406

6 Medium

AI Score

Confidence

High

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.047 Low

EPSS

Percentile

92.5%

JSON

Related for CVE-2004-2293

cve1