1920 matches found
[waraxe-2004-SA#018 - Admin-level authentication bypass in phpnuke 6.x-7.2]
================================================================================ waraxe-2004-SA018 ================================================================================ Admin-level authentication bypass in phpnuke 6.x-7.2...
PHP-Nuke 6.x/7.x - Multiple SQL Injections
source: https://www.securityfocus.com/bid/10135/info Reportedly PHP-Nuke is prone to multiple SQL injection vulnerabilities. These issues are due to a failure of the application to properly sanitize user supplied input. As a result of these issues an attacker could modify the logic and structure ...
PHP-Nuke 6.x/7.x - CookieDecode Cross-Site Scripting
source: https://www.securityfocus.com/bid/10128/info Reportedly PHP-NuKe is prone to a remote cross-site scripting vulnerability. This issue is due to a failure of the 'cookiedecode' function to properly sanitize user supplied cookie parameters. These issues could permit a remote attacker to crea...
CVE-2004-1930
Cross-site scripting XSS vulnerability in the cookiedecode function in mainfile.php for PHP-Nuke 6.x through 7.2, when themes are used, allows remote attackers to inject arbitrary web script or HTML via a base64-encoded user parameter or cookie...
CVE-2004-1932
SQL injection vulnerability in 1 auth.php and 2 admin.php in PHP-Nuke 6.x through 7.2 allows remote attackers to execute arbitrary SQL code and create an administrator account via base64-encoded SQL in the admin parameter...
[waraxe-2004-SA#015 - Multiple vulnerabilities in NukeCalendar v1.1.a]
================================================================================ waraxe-2004-SA015 ================================================================================ Multiple vulnerabilities in NukeCalendar v1.1.a...
waraxe-2004-SA015.txt
================================================================================ waraxe-2004-SA015 ================================================================================ Multiple vulnerabilities in NukeCalendar v1.1.a...
NukeCalendar 1.1.a - 'block-Calendar1.php' Full Path Disclosure
source: https://www.securityfocus.com/bid/10082/info NukeCalendar, which is a third-party calendar module for PHP-Nuke, is prone to multiple vulnerabilities. These issues include path disclosure, SQL injection and cross-site scripting. Possible consequences include disclosure of sensitive...
[waraxe-2004-SA#011 - Multiple vulnerabilities in MS Analysis v2.0 module for PhpNuke]
================================================================================ waraxe-2004-SA011 ================================================================================ Multiple vulnerabilities in MS Analysis v2.0 module for PhpNuke...
CVE-2004-1840
Multiple cross-site scripting XSS vulnerabilities in MS Analysis module 2.0 for PHP-Nuke allows remote attackers to inject arbitrary web script or HTML via the 1 screen parameter to modules.php, 2 modulename parameter to title.php, 3 sortby parameter to modules.php, or 4 overview parameter to...
CVE-2004-1839
MS Analysis module 2.0 for PHP-Nuke allows remote attackers to obtain sensitive information via a direct request to 1 browsers.php, 2 mstrack.php, or 3 title.php, which reveal the full path in a PHP error message...
PHP-Nuke MS-Analysis Module - HTTP Referrer Field SQL Injection
PHP-Nuke MS-Analysis Module - HTTP Referrer Field SQL Injection source: https://www.securityfocus.com/bid/9948/info Reportedly the MS-Analysis module is prone to a remote SQL injection vulnerability. This issue is due to a failure to properly sanitize user supplied HTTP header input before using ...
PHP-Nuke MS-Analysis Module - Multiple Cross-Site Scripting Vulnerabilities
source: https://www.securityfocus.com/bid/9947/info It has been reported that MS-Analysis is prone to a multiple cross-site scripting vulnerabilities. These issues are due to a failure of the application to properly sanitize user supplied URI parameters. These issues could permit a remote attacke...
CVE-2004-0266
Affects Php-Nuke 6.x to 7.1.0 where the SQL injection vulnerability is in the public_message capability (c_mid parameter) that can disclose the administrator password. Exploitation details or specific patches are not provided in the connected documents. The OpenVAS/Nessus references confirm long-...
CVE-2004-0269
CVE-2004-0269 concerns a SQL injection vulnerability in PHP-Nuke 6.9 and earlier (and possibly 7.x). The vulnerability enables remote attackers to inject arbitrary SQL code and potentially read sensitive information via input in two modules: (1) the category variable in the Search module and (2) ...
CVE-2004-0265
Cross-site scripting XSS vulnerability in modules.php for Php-Nuke 6.x-7.1.0 allows remote attackers to execute arbitrary script as other users via URL-encoded 1 title or 2 fname parameters in the News or Reviews modules...
CVE-2004-0269
SQL injection vulnerability in PHP-Nuke 6.9 and earlier, and possibly 7.x, allows remote attackers to inject arbitrary SQL code and gain sensitive information via 1 the category variable in the Search module or 2 the admin variable in the WebLinks module...
CVE-2004-0265
This CVE concerns a Cross-site Scripting (XSS) vulnerability in Php-Nuke 6.x-7.1.0, specifically in modules.php. The vulnerability allows remote attackers to execute arbitrary script as other users by manipulating URL-encoded parameters (1) title or (2) fname in the News or Reviews modules. Affec...
CVE-2004-1830
error.php in Error Manager 2.1 for PHP-Nuke 6.0 allows remote attackers to obtain sensitive information via an invalid 1 language, 2 newlang, or 3 lang parameter, which leaks the pathname in a PHP error message...