CVE-2004-2295

CVE-2004-2295 involves a SQL injection in the Reviews module of PHP-Nuke versions 6.0 through 7.3. The vulnerability allows remote attackers to execute arbitrary SQL commands by manipulating the order parameter, enabling potential data disclosure or modification. The provided documents identify t...

CVE-2004-2293

Multiple cross-site scripting XSS vulnerabilities in PHP-Nuke 6.0 to 7.3 allow remote attackers to inject arbitrary web script or HTML via the 1 eid parameter or 2 query parameter to the Encyclopedia module, 3 previewreview function in the Reviews module as demonstrated by the url, cover,...

CVE-2004-2294

Canonicalize-before-filter error in the sendreview function in the Reviews module for PHP-Nuke 6.0 to 7.3 allows remote attackers to inject arbitrary web script or HTML via hex-encoded XSS sequences in the text parameter, which is checked for dangerous sequences before it is canonicalized, leadin...

CVE-2001-1524

Cross-site scripting XSS vulnerability in PHP-Nuke 5.3.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the 1 uname parameter in user.php, 2 ttitle, letter and file parameters in modules.php, 3 subject, story and storyext parameters in submit.php, 4 upload paramete...

CVE-2002-1995

Cross-site scripting XSS vulnerability in phptonuke.php for PHP-Nuke allows remote attackers to inject arbitrary web script or HTML via the filnavn parameter...

CVE-2001-1524

CVE-2001-1524 describes an XSS vulnerability in PHP-Nuke 5.3.1 and earlier. The flaw allows remote attackers to inject arbitrary web script or HTML via multiple parameters: (1) uname in user.php; (2) ttitle, letter and file in modules.php; (3) subject, story and storyext in submit.php; (4) upload...

CVE-2002-1995

CVE-2002-1995: A cross-site scripting (XSS) vulnerability in phptonuke.php for PHP-Nuke allows remote attackers to inject arbitrary web script or HTML via the filnavn parameter. Affected component is phptonuke.php within PHP-Nuke; the underlying issue is input that is not properly sanitized, enab...

CVE-2002-2032

The CVE-2002-2032 issue affects PHP-Nuke 5.4 and earlier, where sql_layer.php’s debugging feature is not restricted. This enables remote attackers to disclose SQL query information by setting sql_debug (e.g., in index.php or modules.php). Impact is information disclosure of all SQL queries, not r...

CVE-2001-1523

CVE-2001-1523 describes a cross-site scripting (XSS) vulnerability in the DMOZGateway module for PHP-Nuke. The issue stems from improper handling of the topic parameter, allowing remote attackers to inject arbitrary web script or HTML. Affected component: DMOZGateway within PHP-Nuke (topic parame...

CVE-2001-1523

Cross-site scripting XSS vulnerability in the DMOZGateway module for PHP-Nuke allows remote attackers to inject arbitrary web script or HTML via the topic parameter...

CVE-2001-1522

Cross-site scripting XSS vulnerability in im.php in IMessenger for PHP-Nuke allows remote attackers to inject arbitrary web script or HTML via a message...

CVE-2002-2032

sqllayer.php in PHP-Nuke 5.4 and earlier does not restrict access to debugging features, which allows remote attackers to gain SQL query information by setting the sqldebug parameter to 1 index.php and 2 modules.php...

CVE-2001-1522

The CVE-2001-1522 entry describes an XSS vulnerability in im.php of IMessenger for PHP-Nuke , allowing remote attackers to inject arbitrary script or HTML via a message. Affected software: IMessenger for PHP-Nuke; root cause: insufficient input sanitization in im.php. Impact: partial integrity im...

sile002adv.txt

---- sile002 advisory + PoC PRODUCT: PHP-Nuke VERSION: 7.5 but others versions maybe either vulnerables VENDOR: http://www.phpnuke.org VULNERABILITY: Multiple vulnerability RISK: Hight Found by: Silentium of Anacron Group Italy date: 02/05/2005 e-mail: anacrongroupitalyatautisticidotorg myhome:...

CVE-2005-2064

Multiple cross-site scripting vulnerabilities in ASP Nuke 0.80 allow remote attackers to inject arbitrary web script or HTML via the 1 email parameter to forgotpassword.asp, or the 2 FirstName, 3 LastName, 4 Username, 5 Password, 6 Address1, 7 Address2, 8 City, 9 ZipCode, 10 Email parameter to...

CVE-2005-2065

HTTP response splitting vulnerability in languageselect.asp in ASP Nuke 0.80 allows remote attackers to spoof web content and poison web caches via CRLF "%0d%0a" sequences in the LangCode parameter...

CVE-2005-2066

SQL injection vulnerability in commentpost.asp in ASP Nuke 0.80 allows remote attackers to execute arbitrary SQL statements via the TaskID parameter...

M4DR007-07SA.txt

M4DR007-07SA security advisory: Multiple vulnerabilities in ASP Nuke 0.80 Published: 26 16 2005 Released: 26 16 2005 Name: ASP Nuke Affected Systems: req " SIZE="22" MAXLENGTH="80" class="form" ... ? As we can see there isn't any control on the 'email' parameter when the board get it's value. Sin...

CVE-2005-2065

HTTP response splitting vulnerability in languageselect.asp in ASP Nuke 0.80 allows remote attackers to spoof web content and poison web caches via CRLF "%0d%0a" sequences in the LangCode parameter...

CVE-2005-2065

Affected product: ASP Nuke 0.80 (language_select.asp). Vulnerability: HTTP response splitting via CRLF ("%0d%0a") in the LangCode parameter. Impact (as stated): remote attackers can spoof web content and poison web caches. Root cause: unsafely untrusted LangCode parameter allowing CRLF sequences....