CVE-2004-2297

The CVE-2004-2297 case concerns the Reviews module of PHP-Nuke versions 6.0 through 7.3. The vulnerability is a denial of service caused by a large, out-of-range score parameter that can consume CPU and memory. The available sources (NVD, CVE lists) describe the impact as a CPU/memory DoS but do ...

CVE-2004-2294

CVE-2004-2294 affects PHP-Nuke 6.0 through 7.3, where the send_review function in the Reviews module has a canonicalize-before-filter error. Text parameter processing allows remote attackers to inject arbitrary web script or HTML via hex-encoded XSS sequences after the text is checked for dangero...

CVE-2001-1523

Cross-site scripting XSS vulnerability in the DMOZGateway module for PHP-Nuke allows remote attackers to inject arbitrary web script or HTML via the topic parameter...

CVE-2001-1524

Cross-site scripting XSS vulnerability in PHP-Nuke 5.3.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the 1 uname parameter in user.php, 2 ttitle, letter and file parameters in modules.php, 3 subject, story and storyext parameters in submit.php, 4 upload paramete...

CVE-2001-1522

Cross-site scripting XSS vulnerability in im.php in IMessenger for PHP-Nuke allows remote attackers to inject arbitrary web script or HTML via a message...

CVE-2001-1522

The CVE-2001-1522 entry describes an XSS vulnerability in im.php of IMessenger for PHP-Nuke , allowing remote attackers to inject arbitrary script or HTML via a message. Affected software: IMessenger for PHP-Nuke; root cause: insufficient input sanitization in im.php. Impact: partial integrity im...

CVE-2001-1524

CVE-2001-1524 describes an XSS vulnerability in PHP-Nuke 5.3.1 and earlier. The flaw allows remote attackers to inject arbitrary web script or HTML via multiple parameters: (1) uname in user.php; (2) ttitle, letter and file in modules.php; (3) subject, story and storyext in submit.php; (4) upload...

CVE-2002-2032

The CVE-2002-2032 issue affects PHP-Nuke 5.4 and earlier, where sql_layer.php’s debugging feature is not restricted. This enables remote attackers to disclose SQL query information by setting sql_debug (e.g., in index.php or modules.php). Impact is information disclosure of all SQL queries, not r...

CVE-2002-1995

CVE-2002-1995: A cross-site scripting (XSS) vulnerability in phptonuke.php for PHP-Nuke allows remote attackers to inject arbitrary web script or HTML via the filnavn parameter. Affected component is phptonuke.php within PHP-Nuke; the underlying issue is input that is not properly sanitized, enab...

CVE-2002-1995

Cross-site scripting XSS vulnerability in phptonuke.php for PHP-Nuke allows remote attackers to inject arbitrary web script or HTML via the filnavn parameter...

CVE-2002-2032

sqllayer.php in PHP-Nuke 5.4 and earlier does not restrict access to debugging features, which allows remote attackers to gain SQL query information by setting the sqldebug parameter to 1 index.php and 2 modules.php...

CVE-2001-1523

CVE-2001-1523 describes a cross-site scripting (XSS) vulnerability in the DMOZGateway module for PHP-Nuke. The issue stems from improper handling of the topic parameter, allowing remote attackers to inject arbitrary web script or HTML. Affected component: DMOZGateway within PHP-Nuke (topic parame...

sile002adv.txt

---- sile002 advisory + PoC PRODUCT: PHP-Nuke VERSION: 7.5 but others versions maybe either vulnerables VENDOR: http://www.phpnuke.org VULNERABILITY: Multiple vulnerability RISK: Hight Found by: Silentium of Anacron Group Italy date: 02/05/2005 e-mail: anacrongroupitalyatautisticidotorg myhome:...

CVE-2005-2065

HTTP response splitting vulnerability in languageselect.asp in ASP Nuke 0.80 allows remote attackers to spoof web content and poison web caches via CRLF "%0d%0a" sequences in the LangCode parameter...

CVE-2005-2064

Multiple cross-site scripting vulnerabilities in ASP Nuke 0.80 allow remote attackers to inject arbitrary web script or HTML via the 1 email parameter to forgotpassword.asp, or the 2 FirstName, 3 LastName, 4 Username, 5 Password, 6 Address1, 7 Address2, 8 City, 9 ZipCode, 10 Email parameter to...

CVE-2005-2066

SQL injection vulnerability in commentpost.asp in ASP Nuke 0.80 allows remote attackers to execute arbitrary SQL statements via the TaskID parameter...

M4DR007-07SA.txt

M4DR007-07SA security advisory: Multiple vulnerabilities in ASP Nuke 0.80 Published: 26 16 2005 Released: 26 16 2005 Name: ASP Nuke Affected Systems: req " SIZE="22" MAXLENGTH="80" class="form" ... ? As we can see there isn't any control on the 'email' parameter when the board get it's value. Sin...

CVE-2005-2064

Multiple cross-site scripting vulnerabilities in ASP Nuke 0.80 allow remote attackers to inject arbitrary web script or HTML via the 1 email parameter to forgotpassword.asp, or the 2 FirstName, 3 LastName, 4 Username, 5 Password, 6 Address1, 7 Address2, 8 City, 9 ZipCode, 10 Email parameter to...

CVE-2005-2065

Affected product: ASP Nuke 0.80 (language_select.asp). Vulnerability: HTTP response splitting via CRLF ("%0d%0a") in the LangCode parameter. Impact (as stated): remote attackers can spoof web content and poison web caches. Root cause: unsafely untrusted LangCode parameter allowing CRLF sequences....

CVE-2002-1803

CVE-2002-1803 describes a cross-site scripting (XSS) flaw in PHP-Nuke 6.0 that allows remote attackers to inject arbitrary script/HTML via Javascript in an IMG tag. Affected software is PHP-Nuke 6.0; the root cause is an XSS vulnerability exposed by image tags, enabling arbitrary code execution i...