CVE-2004-0265: Undefined Security Weakness

Cross-site scripting XSS vulnerability in modules.php for Php-Nuke 6.x-7.1.0 allows remote attackers to execute arbitrary script as other users via URL-encoded 1 title or 2 fname parameters in the News or Reviews modules...

CVE-2004-0266: Undefined Security Weakness

SQL injection vulnerability in the "public message" capability publicmessage for Php-Nuke 6.x to 7.1.0 allows remote attackers to obtain the administrator password via the cmid parameter...

CVE-2004-0269: Undefined Security Weakness

SQL injection vulnerability in PHP-Nuke 6.9 and earlier, and possibly 7.x, allows remote attackers to inject arbitrary SQL code and gain sensitive information via 1 the category variable in the Search module or 2 the admin variable in the WebLinks module...

PHP-Nuke Error Manager Module 2.1 - error.php?language Full Path Disclosure

PHP-Nuke Error Manager Module 2.1 - error.php?language Full Path Disclosure source: https://www.securityfocus.com/bid/9911/info It has been reported that Error Manager is prone to multiple vulnerabilities. These issues are due to failure to validate user input, failure to handle exceptional...

PHP-Nuke Error Manager Module 2.1 - error.php Multiple Cross-Site Scripting Vulnerabilities

PHP-Nuke Error Manager Module 2.1 - error.php Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/9911/info It has been reported that Error Manager is prone to multiple vulnerabilities. These issues are due to failure to validate user input, failure to handle...

PHP-Nuke Error Manager Module 2.1 - 'error.php' Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/9911/info It has been reported that Error Manager is prone to multiple vulnerabilities. These issues are due to failure to validate user input, failure to handle exceptional conditions and simple design errors. These issues may be leveraged to carry out...

waraxe-2004-SA005.txt

================================================================================ waraxe-2004-SA005 ================================================================================ XSS in Php-Nuke 7.1.0 - part 2 ================================================================================ Autho...

[waraxe-2004-SA#005 - XSS in Php-Nuke 7.1.0 - part 2]

================================================================================ waraxe-2004-SA005 ================================================================================ XSS in Php-Nuke 7.1.0 - part 2 ================================================================================ Autho...

PHP-Nuke 6.x7.07.1 - Image Tag Admin Command Execution

PHP-Nuke 6.x7.07.1 - Image Tag Admin Command Execution source: https://www.securityfocus.com/bid/9895/info It has been reported that PHP-Nuke is prone to a remote admin command execution vulnerability. This issue is due to a design error that allows an attacker to specify arbitrary URI values in...

PHP-Nuke 6.x/7.0/7.1 - Image Tag Admin Command Execution

source: https://www.securityfocus.com/bid/9895/info It has been reported that PHP-Nuke is prone to a remote admin command execution vulnerability. This issue is due to a design error that allows an attacker to specify arbitrary URI values in bbCode tags contained within posts. This issue may be...

CVE-2004-1817

Cross-site scripting XSS vulnerability in modules.php in Php-Nuke 7.1.0 allows remote attackers to inject arbitrary web script or HTML via the 1 Your Name field, 2 e-mail field, 3 nicname field, 4 fname parameter, 5 ratenum parameter, or 6 search field...

CVE-2004-1818

Cross-site scripting XSS vulnerability in nmimage.php in 4nalbum 0.92 for PHP-Nuke 6.5 through 7.0 allows remote attackers to execute arbitrary script as other users by injecting arbitrary script into the z parameter...

CVE-2004-1820

PHP remote file inclusion vulnerability in displaycategory.php in 4nalbum 0.92 for PHP-Nuke 6.5 through 7.0 allows remote attackers to execute arbitrary PHP code by modifying the basepath parameter to reference a URL on a remote web server that contains fileFunctions.php...

CVE-2004-1821

SQL injection vulnerability in 4nalbum 0.92 for PHP-Nuke 6.5 through 7.0 allows remote attackers to gain privileges or perform unauthorized database operations via the gid parameter...

CVE-2004-1819

4nalbum 0.92 for PHP-Nuke 6.5 through 7.0 allows remote attackers to obtain sensitive information via a direct request to displaycategory.php, which reveals the path in an error message...

PHP-Nuke 7.1 Recommend_Us Module - fname Cross-Site Scripting

PHP-Nuke 7.1 RecommendUs Module - fname Cross-Site Scripting source: https://www.securityfocus.com/bid/9879/info It has been reported that PHP-Nuke may be prone to multiple cross-site scripting vulnerabilities. These vulnerabilities occur due to insufficient sanitization of user-supplied data via...

PHP-Nuke 7.1 Recommend_Us Module - 'fname' Cross-Site Scripting

source: https://www.securityfocus.com/bid/9879/info It has been reported that PHP-Nuke may be prone to multiple cross-site scripting vulnerabilities. These vulnerabilities occur due to insufficient sanitization of user-supplied data via the 'Your Name', 'nicname', 'fname', 'ratenum', and 'search'...

[waraxe-2004-SA#003] - SQL injection in Php-Nuke 7.1.0

================================================================================ waraxe-2004-SA003 ================================================================================ SQL injection in Php-Nuke 7.1.0 ================================================================================...

PHP-Nuke 6.x7.0 News Module - Cross-Site Scripting

PHP-Nuke 6.x7.0 News Module - Cross-Site Scripting source: https://www.securityfocus.com/bid/9605/info It has been reported that the PHP-Nuke module 'News' is prone to a cross-site scripting vulnerability. The issue arises due to the module failing to properly sanitize user-supplied information...

PHP-Nuke 6.x7.x - Public Message SQL Injection

PHP-Nuke 6.x7.x - Public Message SQL Injection source: https://www.securityfocus.com/bid/9615/info It has been reported that the 'public message' feature of PHP-Nuke is vulnerable to an SQL injection vulnerability. The issue is due to improper sanitization of user-defined parameters supplied to t...