CVE-2004-2000

The vuln is in Php-Nuke (Downloads module) versions 6.x through 7.2, caused by an SQL injection in modules.php via the (1) orderby or (2) sid parameters. This allows remote attackers to modify/execute arbitrary SQL as described in CVE-2004-2000. No remediation or patch details are provided in the...

CVE-2004-1998

The Downloads module in Php-Nuke 6.x through 7.2 allows remote attackers to gain sensitive information via an invalid show parameter to modules.php, which reveals the full path in a PHP error message...

CVE-2004-1999

Cross-site scripting XSS vulnerability in the Downloads module in Php-Nuke 6.x through 7.2 allows remote attackers to inject arbitrary HTML and web script via the 1 ttitle or 2 sid parameters to modules.php...

CVE-2004-2000

SQL injection vulnerability in the Downloads module in Php-Nuke 6.x through 7.2 allows remote attackers to execute arbitrary SQL via the 1 orderby or 2 sid parameters to modules.php...

CVE-2004-1957

Multiple XSS vulnerabilities affect PostNuke 0.726. Affected vectors include (1) lid and a query parameter to the Downloads module, (2) a query parameter to the Web_links module, and (3) the hlpfile parameter to openwindow.php, enabling remote attackers to inject arbitrary web script or HTML. The...

CVE-2004-1957

Multiple cross-site scripting XSS vulnerabilities in PostNuke 0.726 allows remote attackers to inject arbitrary web script or HTML via the 1 lid and query parameters to the Downloads module, 2 query parameter to the Weblinks module, or 3 hlpfile parameter to openwindow.php...

CVE-2004-1998

CVE-2004-1998 affects Php-Nuke (Downloads module) versions 6.x–7.2. The issue stems from an invalid show parameter to modules.php, which causes a PHP error message that reveals the full filesystem path, enabling information disclosure. Impact is limited to confidentiality (full path exposure); ex...

CVE-2004-1957: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in PostNuke 0.726 allows remote attackers to inject arbitrary web script or HTML via the 1 lid and query parameters to the Downloads module, 2 query parameter to the Weblinks module, or 3 hlpfile parameter to openwindow.php...

CVE-2004-2000: Undefined Security Weakness

SQL injection vulnerability in the Downloads module in Php-Nuke 6.x through 7.2 allows remote attackers to execute arbitrary SQL via the 1 orderby or 2 sid parameters to modules.php...

CVE-2004-1998: Undefined Security Weakness

The Downloads module in Php-Nuke 6.x through 7.2 allows remote attackers to gain sensitive information via an invalid show parameter to modules.php, which reveals the full path in a PHP error message...

CVE-2004-1999: Undefined Security Weakness

Cross-site scripting XSS vulnerability in the Downloads module in Php-Nuke 6.x through 7.2 allows remote attackers to inject arbitrary HTML and web script via the 1 ttitle or 2 sid parameters to modules.php...

CVE-2005-0996

Multiple SQL injection vulnerabilities in the Downloads module for PHP-Nuke 7.6 allow remote attackers to inject arbitrary web script or HTML via 1 the email or url parameters in the Add function, 2 the min parameter in the viewsdownload function, or 3 the min parameter in the search function...

CVE-2005-1027

Multiple cross-site scripting XSS vulnerabilities in PHP-Nuke 6.x through 7.6 allow remote attackers to inject arbitrary web script or HTML via the 1 username parameter in the YourAccount module, 2 avatarcategory parameter in the YourAccount module, or 3 lid parameter in the Downloads module...

CVE-2005-1027

The vulnerability concerns PHP-Nuke 6.x through 7.6 with multiple stored/reflected XSS vectors in the web interface. Specifically, arbitrary web script/HTML can be injected via the username parameter in the Your_Account module, the avatarcategory parameter in the Your_Account module, or the lid p...

CVE-2005-1027

Multiple cross-site scripting XSS vulnerabilities in PHP-Nuke 6.x through 7.6 allow remote attackers to inject arbitrary web script or HTML via the 1 username parameter in the YourAccount module, 2 avatarcategory parameter in the YourAccount module, or 3 lid parameter in the Downloads module...

CVE-2005-1027: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in PHP-Nuke 6.x through 7.6 allow remote attackers to inject arbitrary web script or HTML via the 1 username parameter in the YourAccount module, 2 avatarcategory parameter in the YourAccount module, or 3 lid parameter in the Downloads module...

[SECURITYREASON.COM] phpnuke 7.6 Multiple vulnerabilities in Downloads Module cXIb8O3.13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 phpnuke 7.6 Multiple vulnerabilities in Downloads Module cXIb8O3.13 Author: Maksymilian Arciemowicz cXIb8O3 Date: 5.4.2005 from securityreason.com TEAM - --- 0.Description --- PHP-Nuke is a Web Portal System, storytelling software, news system, online...

CVE-2005-0996

CVE-2005-0996 involves multiple SQL injection vulnerabilities in the Downloads module of PHP-Nuke 7.6. The issue allows remote attackers to inject arbitrary web script or HTML via: (1) email or url parameters in Add, (2) min parameter in viewsdownload, and (3) min parameter in search. Affected pr...

CVE-2005-0996: Undefined Security Weakness

Multiple SQL injection vulnerabilities in the Downloads module for PHP-Nuke 7.6 allow remote attackers to inject arbitrary web script or HTML via 1 the email or url parameters in the Add function, 2 the min parameter in the viewsdownload function, or 3 the min parameter in the search function...

PHP-Nuke 6.x7.x Downloads Module - Lid Cross-Site Scripting

PHP-Nuke 6.x7.x Downloads Module - Lid Cross-Site Scripting source: https://www.securityfocus.com/bid/13011/info It is reported that the PHP-Nuke 'Downloads' module is affected by a cross-site scripting vulnerability. This issue is due to a failure of the application to properly sanitize...