CVE-2019-7726

modules/banners/funcs/click.php in NukeViet before 4.3.04 has a SQL INSERT statement with raw header data from an HTTP request e.g., Referer and User-Agent...

CVE-2019-7726

CVE-2019-7726 affects NukeViet prior to 4.3.04. The affected code path is in modules/banners/funcs/click.php, where a SQL INSERT statement incorporates raw header data from HTTP requests (e.g., Referer and User-Agent). The underlying issue is SQL injection risk due to unsanitized header input bei...

CVE-2019-7725

The CVE refers to NukeViet before 4.3.04, where includes/core/is_user.php deserializes the untrusted nvloginhash cookie, relying on PHP serialization instead of JSON. This constitutes a deserialization vulnerability that can lead to remote impact, with CVSS metrics indicating high severity (NVD: ...

CVE-2019-7725

includes/core/isuser.php in NukeViet before 4.3.04 deserializes the untrusted nvloginhash cookie i.e., the code relies on PHP's serialization format when JSON can be used to eliminate the risk...

Vinades NukeViet Code Issue Vulnerability

Vinades NukeViet is an open source Content Management System CMS from VINADES Vinades Vietnam. A security vulnerability exists in NukeViet before 4.3.04, which stems from includes/core/isuser.php deserializing untrusted cookies...

Vinades NukeViet SQL注入漏洞

Vinades NukeViet is an open source content management system CMS from Vinades Vietnam.Vinades NukeViet is vulnerable to a SQL injection vulnerability that originates from a SQL INSERT statement containing raw header data e.g., Referer and User-Agent from HTTP requests. No detailed vulnerability...

Cross-site Request Forgery (CSRF)

nukeviet is vulnerable to cross-site request forgery CSRF. Due to a flaw in the way it handles the admin/index.php?nv=users=useradd URI, it allows a malicious user to create a new admin account, delete sensitive data, compromise the profile details and password of the user without the knowledge o...

CVE-2020-13156

modules\users\admin\adduser.php in NukeViet 4.4 allows CSRF to add a user account via the admin/index.php?nv=users&op=useradd URI...

CVE-2020-13157

modules\users\admin\edit.php in NukeViet 4.4 allows CSRF to change a user's password via an admin/index.php?nv=users&op=edit&userid= URI. The old password is not needed...

CVE-2020-13157

modules\users\admin\edit.php in NukeViet 4.4 allows CSRF to change a user's password via an admin/index.php?nv=users&op=edit&userid= URI. The old password is not needed...

CVE-2020-13155

clearsystem.php in NukeViet 4.4 allows CSRF with resultant HTML injection via the deltype parameter to the admin/index.php?nv=webtools&op=clearsystem URI...

CVE-2020-13156

modules\users\admin\adduser.php in NukeViet 4.4 allows CSRF to add a user account via the admin/index.php?nv=users&op=useradd URI...

CVE-2020-13155

clearsystem.php in NukeViet 4.4 allows CSRF with resultant HTML injection via the deltype parameter to the admin/index.php?nv=webtools&op=clearsystem URI...

Cross site request forgery (csrf)

modules\users\admin\edit.php in NukeViet 4.4 allows CSRF to change a user's password via an admin/index.php?nv=users&op=edit&userid= URI. The old password is not needed...

Cross site request forgery (csrf)

modules\users\admin\adduser.php in NukeViet 4.4 allows CSRF to add a user account via the admin/index.php?nv=users&op=useradd URI...

Cross site request forgery (csrf)

clearsystem.php in NukeViet 4.4 allows CSRF with resultant HTML injection via the deltype parameter to the admin/index.php?nv=webtools&op=clearsystem URI...

CVE-2020-13155

CVE-2020-13155 concerns a CSRF vulnerability in the NukeViet 4.4 product, where the request to CSRF via clearsystem.php can inject HTML when the deltype parameter is used in the URI admin/index.php?nv=webtools&op=clearsystem. The affected component is the clearsystem functionality in NukeViet 4.4...

CVE-2020-13155

clearsystem.php in NukeViet 4.4 allows CSRF with resultant HTML injection via the deltype parameter to the admin/index.php?nv=webtools&op=clearsystem URI...

CVE-2020-13156

modules\users\admin\adduser.php in NukeViet 4.4 allows CSRF to add a user account via the admin/index.php?nv=users&op=useradd URI...

CVE-2020-13156

CVE-2020-13156 affects NukeViet 4.4: the vulnerability lies in modules\users\admin\add_user.php, where CSRF can be abused to add a new user via admin/index.php?nv=users&op=user_add. Exploitation is documented in public advisories (e.g., GitHub GHSA, OSV, Red Hat) and CVSS indicates network access...