CVE-2011-1481

Multiple cross-site scripting XSS vulnerabilities in Francisco Burzi PHP-Nuke 8.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 sendername or 2 senderemail parameter in a Feedback action to modules.php...

CVE-2011-1480

CVE-2011-1480 affects PHP-Nuke (admin.php) in the admin backend of PHP-Nuke 8.0 and earlier. The vulnerability is an SQL injection via the chng_uid parameter, allowing remote attackers to execute arbitrary SQL commands. The available connected documents confirm the affected software/version range...

CVE-2009-1842

SQL injection vulnerability in main/tracking/userLog.php in Francisco Burzi PHP-Nuke 8.0 allows remote attackers to execute arbitrary SQL commands via the HTTP Referer header...

phpnukegaste-sql.txt

PHP-Nuke Copyright © 2005 by Francisco Burzi AUTHOR : TurkishWarriorr SiTE : http://1923turk.org MAİL : [email protected] DORK : allinurl:"PHP-Nuke Copyright © 2005 by Francisco Burzi" DORK : allinurl:"gaestebuchv22&func" EXPLOIT :...

PHP-Nuke Copyright 2005 SQL

PHP-Nuke Copyright © 2005 by Francisco Burzi AUTHOR : TurkishWarriorr SiTE : http://1923turk.org MAL : [email protected] DORK : allinurl:"PHP-Nuke Copyright © 2005 by Francisco Burzi" DORK : allinurl:"gaestebuchv22&func" EXPLOIT :...

CVE-2007-5032

CVE-2007-5032 is a Cross-site request forgery (CSRF) in admin.php of Francisco Burzi’s PHP-Nuke. An attacker can add administrative accounts by sending a request that abuses AddAuthor with crafted add_name/add_radminsuper parameters. Documented impact includes partial confidentiality, integrity, ...

CVE-2007-0372

CVE-2007-0372 involves multiple SQL injection flaws in PHP-Nuke 7.9. The vulnerabilities allow remote attackers to execute arbitrary SQL commands through parameters in admin/modules/modules.php (active) and modules/Advertising/admin/index.php (ad_class, imageurl, clickurl, ad_code, position), plu...

CVE-2007-0309

CVE-2007-0309 describes an SQL injection in PHP-Nuke 7.9 and earlier, via blocks/block-Old_Articles.php when register_globals is enabled and magic_quotes_gpc is disabled. A remote attacker can use the cat parameter to execute arbitrary SQL commands. The vulnerability is evidenced across the CVE/N...

CVE-2006-6200

Multiple SQL injection vulnerabilities in the 1 ratearticle and 2 ratecomplete functions in modules/News/index.php in the News module in Francisco Burzi PHP-Nuke 7.9 and earlier, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the sid parameter...

CVE-2006-6200

The CVE-2006-6200 entry describes multiple SQL injection vulnerabilities in the News module of PHP-Nuke (version 7.9 and earlier). Specifically, the rate_article and rate_complete functions in modules/News/index.php are affected when magic_quotes_gpc is disabled, allowing remote attackers to exec...

[Squid 2004-Nuke-001] Inadequate Security Checking in PHPNuke v7.3 and earlier

=========================================================================== =========================================================================== Advisory: 2004-Nuke-001 Affected Software: PHPNuke Affected Versions: Version 7.3 and earlier Main Developer: Francisco Burzi...