CVE-2026-37197

CVE-2026-37197 - Server-Side Request Forgery SSRF in NukeViet CMS v4.5.07 Overview A Server-Side Request Forgery SSRF vulnerability exists in VINADES JSC NukeViet CMS v4.5.07 within the admin remote upload feature. The issue allows an authenticated administrator to trigger server-side HTTP reques...

NukeViet-RCE-PoC

Cách sử dụng Tool hỗ trợ 4 chức năng chính: 1. Đăng nhậ...

Path Traversal

nukeviet/nukeviet is vulnerable to Path Traversal. The vulnerability is due to insufficient validation of the attach parameter in the administrator Edit Comment function, which allows an authenticated administrator to traverse directories and delete arbitrary files within the application root...

PT-2026-57974

🔴 NukeViet, Path Traversal to Arbitrary File Deletion, CVE-2026-54065 High -DC-Jul2026-955 https://t.co/yASozOdaJS...

CVE-2026-49259

creationtimestamp| type| source ---|---|--- 2026-07-13 18:35:07+00:00| published-proof-of-concept| https://github.com/nukeviet/nukeviet/security/advisories/GHSA-w2w5-w2pw-r929...

CVE-2026-54064

creationtimestamp| type| source ---|---|--- 2026-07-13 18:35:05+00:00| published-proof-of-concept| https://github.com/nukeviet/nukeviet/security/advisories/GHSA-465g-4q99-5x86...

CVE-2026-55372

creationtimestamp| type| source ---|---|--- 2026-07-13 18:35:03+00:00| published-proof-of-concept| https://github.com/nukeviet/nukeviet/security/advisories/GHSA-4chg-4752-w88r...

GHSA-4CHG-4752-W88R NukeViet: Pre-authentication SSRF via X-Forwarded-Host

Summary An unauthenticated attacker can coerce the server into issuing HTTP requests to an attacker-chosen host by spoofing the X Forwarded-Host and X-Forwarded-Proto request headers. The forwarded host is used, without validation, to build the URL that serverinfoupdate fetches with cURL, resulti...

NukeViet: Pre-authentication SSRF via X-Forwarded-Host

Summary An unauthenticated attacker can coerce the server into issuing HTTP requests to an attacker-chosen host by spoofing the X Forwarded-Host and X-Forwarded-Proto request headers. The forwarded host is used, without validation, to build the URL that serverinfoupdate fetches with cURL, resulti...

Server-side Request Forgery (SSRF)

Overview nukeviet/nukeviet is a the first opensource CMS in Vietnam. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through the serverinfoupdate function in includes/ini.php and the forwarded-host handling in vendor/vinades/nukeviet/Core/Server.php. An attack...

NukeViet: Path Traversal to Arbitrary File Deletion in Edit Comment Function

Summary Path Traversal to Arbitrary File Deletion in the Edit Comment admin function. An authenticated administrator can delete arbitrary files within the application root e.g., config.php by injecting a crafted attach parameter, rendering the application inoperable. Affected Component...

Directory Traversal

Overview nukeviet/nukeviet is a the first opensource CMS in Vietnam. Affected versions of this package are vulnerable to Directory Traversal via the attach parameter in the comment editing process. An attacker can cause arbitrary file deletion by injecting a crafted value that leverages path...

NukeViet: Multiple Anti-XSS Filter Bypasses Leading to Stored XSS in News Module

Summary Two filter-bypass techniques in NukeViet\Core\Request::filterAttr and NukeViet\Core\Request::unhtmlentities allow a low-privileged user any account with news post permission to store and serve arbitrary JavaScript to any visitor of the affected page. Affected Component...

GHSA-465G-4Q99-5X86 NukeViet: Multiple Anti-XSS Filter Bypasses Leading to Stored XSS in News Module

Summary Two filter-bypass techniques in NukeViet\Core\Request::filterAttr and NukeViet\Core\Request::unhtmlentities allow a low-privileged user any account with news post permission to store and serve arbitrary JavaScript to any visitor of the affected page. Affected Component...

Cross-site Scripting (XSS)

Overview nukeviet/nukeviet is a the first opensource CMS in Vietnam. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the filterAttr and unhtmlentities functions. An attacker can execute arbitrary JavaScript in the browsers of users who view crafted content by...

GHSA-W2W5-W2PW-R929 NukeViet: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Summary A stored cross-site scripting XSS vulnerability exists in NukeViet CMS versions 4.x through 4.5.08. A low-privileged authenticated user can store a JavaScript payload in their profile's display name fields. The payload executes in the browser of any visitor — including administrators — wh...

NukeViet: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Summary A stored cross-site scripting XSS vulnerability exists in NukeViet CMS versions 4.x through 4.5.08. A low-privileged authenticated user can store a JavaScript payload in their profile's display name fields. The payload executes in the browser of any visitor — including administrators — wh...

Cross-site Scripting (XSS)

Overview nukeviet/nukeviet is a the first opensource CMS in Vietnam. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the COMMENT.postname template variable, which is interpolated without proper JavaScript-context escaping into an inline onclick handler. An attacke...

GHSA-MXPF-QGG6-V3FF NukeViet: Unauthenticated Reflected XSS in Comment Module

Summary Reflected XSS in the Comment module via the statuscomment URL parameter. The parameter accepts attacker-controlled base64-encoded HTML/JavaScript that is decoded server-side and rendered unescaped into the page. Compounded by a second flaw: the checkss anti-forgery token was derived from ...

Cross-site Scripting (XSS)

Overview nukeviet/nukeviet is a the first opensource CMS in Vietnam. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the statuscomment parameter, which is base64-decoded and rendered unescaped into the page. An attacker can execute arbitrary JavaScript in the...