Path Traversal

nukeviet/nukeviet is vulnerable to Path Traversal. The vulnerability is due to insufficient validation of the attach parameter in the administrator Edit Comment function, which allows an authenticated administrator to traverse directories and delete arbitrary files within the application root...

PT-2026-57974

🔴 NukeViet, Path Traversal to Arbitrary File Deletion, CVE-2026-54065 High -DC-Jul2026-955 https://t.co/yASozOdaJS...

CVE-2026-49259

creationtimestamp| type| source ---|---|--- 2026-07-13 18:35:07+00:00| published-proof-of-concept| https://github.com/nukeviet/nukeviet/security/advisories/GHSA-w2w5-w2pw-r929...

CVE-2026-54064

creationtimestamp| type| source ---|---|--- 2026-07-13 18:35:05+00:00| published-proof-of-concept| https://github.com/nukeviet/nukeviet/security/advisories/GHSA-465g-4q99-5x86...

CVE-2026-55372

creationtimestamp| type| source ---|---|--- 2026-07-13 18:35:03+00:00| published-proof-of-concept| https://github.com/nukeviet/nukeviet/security/advisories/GHSA-4chg-4752-w88r...

GHSA-4CHG-4752-W88R NukeViet: Pre-authentication SSRF via X-Forwarded-Host

Summary An unauthenticated attacker can coerce the server into issuing HTTP requests to an attacker-chosen host by spoofing the X Forwarded-Host and X-Forwarded-Proto request headers. The forwarded host is used, without validation, to build the URL that serverinfoupdate fetches with cURL, resulti...

NukeViet: Path Traversal to Arbitrary File Deletion in Edit Comment Function

Summary Path Traversal to Arbitrary File Deletion in the Edit Comment admin function. An authenticated administrator can delete arbitrary files within the application root e.g., config.php by injecting a crafted attach parameter, rendering the application inoperable. Affected Component...

Directory Traversal

Overview nukeviet/nukeviet is a the first opensource CMS in Vietnam. Affected versions of this package are vulnerable to Directory Traversal via the attach parameter in the comment editing process. An attacker can cause arbitrary file deletion by injecting a crafted value that leverages path...

GHSA-465G-4Q99-5X86 NukeViet: Multiple Anti-XSS Filter Bypasses Leading to Stored XSS in News Module

Summary Two filter-bypass techniques in NukeViet\Core\Request::filterAttr and NukeViet\Core\Request::unhtmlentities allow a low-privileged user any account with news post permission to store and serve arbitrary JavaScript to any visitor of the affected page. Affected Component...

GHSA-W2W5-W2PW-R929 NukeViet: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Summary A stored cross-site scripting XSS vulnerability exists in NukeViet CMS versions 4.x through 4.5.08. A low-privileged authenticated user can store a JavaScript payload in their profile's display name fields. The payload executes in the browser of any visitor — including administrators — wh...

Cross-site Scripting (XSS)

Overview nukeviet/nukeviet is a the first opensource CMS in Vietnam. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the COMMENT.postname template variable, which is interpolated without proper JavaScript-context escaping into an inline onclick handler. An attacke...

GHSA-MXPF-QGG6-V3FF NukeViet: Unauthenticated Reflected XSS in Comment Module

Summary Reflected XSS in the Comment module via the statuscomment URL parameter. The parameter accepts attacker-controlled base64-encoded HTML/JavaScript that is decoded server-side and rendered unescaped into the page. Compounded by a second flaw: the checkss anti-forgery token was derived from ...

CVE-2026-41147

NukeViet CMS is a multi Content Management System. Versions 4.5.07 and prior contain a Stored Cross-Site Scripting XSS vulnerability caused by insufficient server-side input sanitization in the Request class. The application relies primarily on client-side filtering to sanitize HTML tags and...

CVE-2026-41147 NukeViet CMS: Stored Cross-Site Scripting (XSS) via insufficient server-side input sanitization in Request class

NukeViet CMS is a multi Content Management System. Versions 4.5.07 and prior contain a Stored Cross-Site Scripting XSS vulnerability caused by insufficient server-side input sanitization in the Request class. The application relies primarily on client-side filtering to sanitize HTML tags and...

CVE-2026-41147 NukeViet CMS: Stored Cross-Site Scripting (XSS) via insufficient server-side input sanitization in Request class

NukeViet CMS is a multi Content Management System. Versions 4.5.07 and prior contain a Stored Cross-Site Scripting XSS vulnerability caused by insufficient server-side input sanitization in the Request class. The application relies primarily on client-side filtering to sanitize HTML tags and...

EUVD-2026-31507

NukeViet CMS is a multi Content Management System. Versions 4.5.07 and prior contain a Stored Cross-Site Scripting XSS vulnerability caused by insufficient server-side input sanitization in the Request class. The application relies primarily on client-side filtering to sanitize HTML tags and...

CVE-2026-41147

CVE-2026-41147 (NukeViet CMS) is a stored XSS issue affecting NukeViet CMS versions up to 4.5.08, caused by insufficient server-side input sanitization in the Request class. The app relies on client-side filtering for user-submitted HTML, which can be bypassed by altering HTTP requests. Attackers...

CVE-2026-41147 NukeViet CMS: Stored Cross-Site Scripting (XSS) via insufficient server-side input sanitization in Request class

NukeViet CMS is a multi Content Management System. Versions 4.5.07 and prior contain a Stored Cross-Site Scripting XSS vulnerability caused by insufficient server-side input sanitization in the Request class. The application relies primarily on client-side filtering to sanitize HTML tags and...

Vinades NukeViet 跨站脚本漏洞

Vinades NukeViet is an open-source content management system CMS developed by the Vietnamese company Vinades. Versions of Vinades NukeViet 4.5.07 and earlier had a cross-site scripting vulnerability. This vulnerability stemmed from insufficient input cleansing on the server side, which could lead...

Stored Cross-Site Scripting (XSS)

nukeviet/nukeviet is vulnerable to Stored Cross-Site Scripting XSS. The vulnerability is due to insufficient server-side input sanitization in the Request class, which relies primarily on client-side filtering, allowing an attacker to bypass validation by modifying HTTP requests and inject...