Lucene search
K
Database
Vendors
Products
Timeline
Vulnerabilities
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
Francisco BurziPhp-nuke7.2

34 matches found

CVE
CVE•added 2005/05/10 4:0 a.m.•113 views

CVE-2004-1988

PHP remote file inclusion vulnerability in init.inc.php in Coppermine Photo Gallery 1.2.0 RC4 allows remote attackers to execute arbitrary PHP code by modifying the CPG_M_DIR to reference a URL on a remote web server that contains functions.inc.php.

7.5CVSS8AI score0.00081EPSS
CVE
CVE•added 2005/05/10 4:0 a.m.•49 views

CVE-2004-1987

picmgmtbatch.inc.php in Coppermine Photo Gallery 1.2.2b and 1.2.0 RC4 allows remote attackers with administrative privileges to execute arbitrary commands via shell metacharacters in the (1) $CONFIG['impath'] or (2) $CONFIG['jpeg_qual'] parameters.

7.5CVSS8.1AI score0.00283EPSS
CVE
CVE•added 2005/05/10 4:0 a.m.•48 views

CVE-2004-1989

PHP remote file inclusion vulnerability in theme.php in Coppermine Photo Gallery 1.2.2b allows remote attackers to execute arbitrary PHP code by modifying the THEME_DIR parameter to reference a URL on a remote web server that contains user_list_info_box.inc.

7.5CVSS8AI score0.00081EPSS
CVE
CVE•added 2005/05/10 4:0 a.m.•45 views

CVE-2004-1972

SQL injection vulnerability in modules.php in PHP-Nuke Video Gallery Module 0.1 Beta 5 allows remote attackers to execute arbitrary SQL code via the (1) clipid or (2) catid parameters in a viewclip, viewcat, or voteclip action.

7.5CVSS8.7AI score0.00021EPSS
CVE
CVE•added 2005/02/15 5:0 a.m.•45 views

CVE-2005-0433

Php-Nuke 7.5 allows remote attackers to determine the full path of the web server via invalid or missing arguments to (1) db.php, (2) mainfile.php, (3) Downloads/index.php, or (4) Web_Links/index.php, which lists the path in a PHP error message.

5CVSS7.2AI score0.00032EPSS
CVE
CVE•added 2005/05/02 4:0 a.m.•45 views

CVE-2005-1027

Multiple cross-site scripting (XSS) vulnerabilities in PHP-Nuke 6.x through 7.6 allow remote attackers to inject arbitrary web script or HTML via the (1) username parameter in the Your_Account module, (2) avatarcategory parameter in the Your_Account module, or (3) lid parameter in the Downloads mod...

4.3CVSS6AI score0.00042EPSS
CVE
CVE•added 2005/12/15 11:3 a.m.•44 views

CVE-2005-4260

Interpretation conflict in includes/mainfile.php in PHP-Nuke 7.9 and later allows remote attackers to perform cross-site scripting (XSS) attacks by replacing the ">" in the tag with a "<", which bypasses the regular expressions that sanitize the data, but is automatically corrected by many we...

4.3CVSS6.1AI score0.00024EPSS
CVE
CVE•added 2005/08/04 4:0 a.m.•42 views

CVE-2004-2294

Canonicalize-before-filter error in the send_review function in the Reviews module for PHP-Nuke 6.0 to 7.3 allows remote attackers to inject arbitrary web script or HTML via hex-encoded XSS sequences in the text parameter, which is checked for dangerous sequences before it is canonicalized, leading...

4.3CVSS5.4AI score0.00056EPSS
CVE
CVE•added 2005/08/04 4:0 a.m.•42 views

CVE-2004-2297

The Reviews module in PHP-Nuke 6.0 to 7.3 allows remote attackers to cause a denial of service (CPU and memory consumption) via a large, out-of-range score parameter.

5CVSS7AI score0.00352EPSS
CVE
CVE•added 2005/05/10 4:0 a.m.•41 views

CVE-2004-1984

Coppermine Photo Gallery 1.2.2b and 1.2.0 RC4 allows remote attackers to obtain sensitive information via a direct HTTP request to (1) phpinfo.php, (2) addpic.php, (3) config.php, (4) db_input.php, (5) displayecard.php, (6) ecard.php, (7) crop.inc.php, which reveal the full path in a PHP error mess...

5CVSS6.6AI score0.0055EPSS
CVE
CVE•added 2005/05/10 4:0 a.m.•40 views

CVE-2004-1985

Cross-site scripting (XSS) vulnerability in menu.inc.php in Coppermine Photo Gallery 1.2.2b allows remote attackers to inject arbitrary HTML or web script via the CPG_URL parameter.

4.3CVSS6AI score0.00164EPSS
CVE
CVE•added 2005/05/10 4:0 a.m.•40 views

CVE-2004-1999

Cross-site scripting (XSS) vulnerability in the Downloads module in Php-Nuke 6.x through 7.2 allows remote attackers to inject arbitrary HTML and web script via the (1) ttitle or (2) sid parameters to modules.php.

4.3CVSS6.1AI score0.00885EPSS
CVE
CVE•added 2006/11/04 1:7 a.m.•40 views

CVE-2006-5720

SQL injection vulnerability in modules/journal/search.php in the Journal module in Francisco Burzi PHP-Nuke 7.9 and earlier allows remote attackers to execute arbitrary SQL commands via the forwhat parameter.

7.5CVSS8.4AI score0.00186EPSS
CVE
CVE•added 2005/05/10 4:0 a.m.•39 views

CVE-2004-1930

Cross-site scripting (XSS) vulnerability in the cookiedecode function in mainfile.php for PHP-Nuke 6.x through 7.2, when themes are used, allows remote attackers to inject arbitrary web script or HTML via a base64-encoded user parameter or cookie.

4.3CVSS5.9AI score0.00171EPSS
CVE
CVE•added 2005/05/10 4:0 a.m.•38 views

CVE-2004-1929

SQL injection vulnerability in the bblogin function in functions.php in PHP-Nuke 6.x through 7.2 allows remote attackers to bypass authentication and gain access by injecting base64-encoded SQL code into the user parameter.

7.5CVSS8.6AI score0.00131EPSS
CVE
CVE•added 2005/05/03 4:0 a.m.•38 views

CVE-2005-1386

PHP-Nuke 7.6 and earlier allows remote attackers to obtain sensitive information via a direct request to (1) ipban.php, (2) db.php, (3) lang-norwegian.php, (4) lang-indonesian.php, (5) lang-greek.php, (6) a request to Web_Links with the portuguese language (lang-portuguese.php), (7) a request to We...

5CVSS6.6AI score0.00014EPSS
CVE
CVE•added 2005/05/10 4:0 a.m.•37 views

CVE-2004-1986

Directory traversal vulnerability in modules.php in Coppermine Photo Gallery 1.2.2b and 1.2.0 RC4 allows remote attackers with administrative privileges to read arbitrary files via a .. (dot dot) in the startdir parameter.

5CVSS7.1AI score0.00111EPSS
CVE
CVE•added 2006/02/21 2:2 a.m.•37 views

CVE-2006-0805

The CAPTCHA functionality in php-Nuke 6.0 through 7.9 uses fixed challenge/response pairs that only vary once per day based on the User Agent (HTTP_USER_AGENT), which allows remote attackers to bypass CAPTCHA controls by fixing the User Agent, performing a valid challenge/response, then replaying t...

7.5CVSS6.7AI score0.01759EPSS
CVE
CVE•added 2005/05/10 4:0 a.m.•36 views

CVE-2004-1932

SQL injection vulnerability in (1) auth.php and (2) admin.php in PHP-Nuke 6.x through 7.2 allows remote attackers to execute arbitrary SQL code and create an administrator account via base64-encoded SQL in the admin parameter.

7.5CVSS8.7AI score0.00021EPSS
CVE
CVE•added 2005/09/21 9:3 p.m.•36 views

CVE-2005-3016

Multiple unspecified vulnerabilities in the WYSIWYG editor in PHP-Nuke before 7.9 Final have unknown impact and attack vectors.

10CVSS7.2AI score0.00018EPSS
CVE
CVE•added 2005/05/10 4:0 a.m.•35 views

CVE-2004-1998

The Downloads module in Php-Nuke 6.x through 7.2 allows remote attackers to gain sensitive information via an invalid show parameter to modules.php, which reveals the full path in a PHP error message.

5CVSS7AI score0.00022EPSS
CVE
CVE•added 2005/05/02 4:0 a.m.•35 views

CVE-2005-0999

SQL injection vulnerability in the Top module for PHP-Nuke 6.x through 7.6 allows remote attackers to execute arbitrary SQL commands via the querylang parameter.

7.5CVSS8.8AI score0.00019EPSS
CVE
CVE•added 2005/05/02 4:0 a.m.•35 views

CVE-2005-1023

Multiple cross-site scripting (XSS) vulnerabilities in PHP-Nuke 6.x to 7.6 allow remote attackers to inject arbitrary web script or HTML via the (1) min parameter to the Search module, (2) the categories parameter to the FAQ module, or (3) the ltr parameter to the Encyclopedia module. NOTE: the bid...

4.3CVSS6AI score0.00119EPSS
CVE
CVE•added 2005/05/02 4:0 a.m.•35 views

CVE-2005-1024

modules.php in PHP-Nuke 6.x to 7.6 allows remote attackers to obtain sensitive information via a direct request to (1) my_headlines, (2) userinfo, or (3) search, which reveals the path in a PHP error message.

5CVSS6.6AI score0.00053EPSS
CVE
CVE•added 2005/05/10 4:0 a.m.•34 views

CVE-2004-2044

PHP-Nuke 7.3, and other products that use the PHP-Nuke codebase such as the Nuke Cops betaNC PHP-Nuke Bundle, OSCNukeLite 3.1, and OSC2Nuke 7x do not properly use the eregi() PHP function with $_SERVER['PHP_SELF'] to identify the calling script, which allows remote attackers to directly access scri...

7.5CVSS7.2AI score0.01076EPSS
CVE
CVE•added 2005/02/15 5:0 a.m.•34 views

CVE-2005-0434

Multiple cross-site scripting (XSS) vulnerabilities in Php-Nuke 7.5 allow remote attackers to inject arbitrary HTML or web script via (1) the newdownloadshowdays parameter in a NewDownloads operation or (2) the newlinkshowdays parameter in a NewLinks operation.

4.3CVSS6.1AI score0.00041EPSS
CVE
CVE•added 2005/08/04 4:0 a.m.•33 views

CVE-2004-2293

Multiple cross-site scripting (XSS) vulnerabilities in PHP-Nuke 6.0 to 7.3 allow remote attackers to inject arbitrary web script or HTML via the (1) eid parameter or (2) query parameter to the Encyclopedia module, (3) preview_review function in the Reviews module as demonstrated by the url, cover, ...

4.3CVSS6.1AI score0.00119EPSS
CVE
CVE•added 2005/08/04 4:0 a.m.•33 views

CVE-2004-2296

The preview_review function in the Reviews module in PHP-Nuke 6.0 to 7.3, when running on Windows systems, allows remote attackers to obtain sensitive information via an invalid date parameter, which generates an error message.

5CVSS6.6AI score0.00035EPSS
CVE
CVE•added 2006/02/13 10:2 p.m.•33 views

CVE-2006-0676

Cross-site scripting (XSS) vulnerability in header.php in PHP-Nuke 6.0 to 7.8 allows remote attackers to inject arbitrary web script or HTML via the pagetitle parameter.

4.3CVSS5.7AI score0.04845EPSS
CVE
CVE•added 2006/12/01 1:28 a.m.•32 views

CVE-2006-6200

Multiple SQL injection vulnerabilities in the (1) rate_article and (2) rate_complete functions in modules/News/index.php in the News module in Francisco Burzi PHP-Nuke 7.9 and earlier, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the sid parameter.

7.5CVSS8.9AI score0.00264EPSS
CVE
CVE•added 2005/05/10 4:0 a.m.•31 views

CVE-2004-2018

PHP remote file inclusion vulnerability in index.php in Php-Nuke 6.x through 7.3 allows remote attackers to execute arbitrary PHP code by modifying the modpath parameter to reference a URL on a remote web server that contains the code.

7.5CVSS8AI score0.00084EPSS
CVE
CVE•added 2005/05/10 4:0 a.m.•31 views

CVE-2004-2020

Multiple cross-site scripting (XSS) vulnerabilities in Php-Nuke 6.x through 7.3 allow remote attackers to inject arbitrary HTML or web script into the (1) optionbox parameter in the News module, (2) date parameter in the Statistics module, (3) year, month, and month_1 parameters in the Stories_Arch...

4.3CVSS6.5AI score0.00039EPSS
CVE
CVE•added 2005/05/10 4:0 a.m.•29 views

CVE-2004-2019

The WebLinks module in Php-Nuke 6.x through 7.3 allows remote attackers to obtain sensitive information via an invalid show parameter, which displays the full path in a PHP error message.

5CVSS6.6AI score0.00027EPSS
CVE
CVE•added 2005/11/24 11:3 a.m.•28 views

CVE-2005-3792

Multiple SQL injection vulnerabilities in the Search module in PHP-Nuke 7.8, and possibly other versions before 7.9 with patch 3.1, allows remote attackers to execute arbitrary SQL commands, as demonstrated via the query parameter in a stories type.

7.5CVSS8.4AI score0.64633EPSS