CVE-2017-12906

NexusPHP has documented cross-site scripting (XSS) vulnerabilities exploited via PATH_INFO to the endpoints cheaters.php and confirm_resend.php. The CVE entry CVE-2017-12906 references XSS impact on NexusPHP with an attack surface described as network-driven and requires no authentication (CVSSv3...

CVE-2017-12655

NexusPHP 1.5 is affected by a Cross-Site Scripting (XSS) vulnerability in log.php, dailylog action, exploitable via the query parameter. The vulnerability allows injection of Web script/HTML and, per CVE data, has PII-impacting integrity (I) but no confidentiality or availability impacts reported...

CVE-2017-12798

CVE-2017-12798 concerns a Cross-Site Scripting (XSS) vulnerability in NexusPHP version 1.5, exploitable via the q parameter to searchsuggest.php. The Red Hat, CNVD, NVD, and other connected records consistently describe a reflected/online XSS risk originating from unsanitized input in the q param...

CVE-2017-12680

Cross-Site Scripting (XSS) exists in NexusPHP 1.5 via the type parameter to shoutbox.php. The description indicates the vulnerability arises from input handling for the type parameter, enabling script injection. Affected software is NexusPHP 1.5 (PHP-based resource sharing software). This CVE is ...

CVE-2017-12792

CVE-2017-12792 affects NexusPHP 1.5. Multiple CSRF vulnerabilities enable remote attackers to hijack administrator sessions by issuing requests that trigger XSS via the linkname, url, or title parameters in an add action to linksmanage.php. Root cause: CSRF in NexusPHP 1.5; impact stated as hijac...

CVE-2017-15305

The CVE-2017-15305 entry describes a cross-site scripting (XSS) vulnerability in NexusPHP 1.5 exploitable via the keyword parameter to messages.php. Multiple connected records (CNVD-2017-32401, RH:CVE-2017-15305, NVD/CVE-2017-15305, PRION/CVE-2017-15305, CVELIST/CVE-2017-15305) corroborate an XSS...

CVE-2017-14534

NVD and multiple public feeds confirm CVE-2017-14534 affects NexusPHP 1.5.beta5.20120707. The vulnerability is a Cross Site Scripting (XSS) flaw exploitable via PATH_INFO to location.php, related to PHP_SELF. Impact is limited to partial integrity impact with no confidentiality/availability effec...

CVE-2017-12907

The CVE-2017-12907 entry describes a Cross-Site Scripting (XSS) vulnerability in NexusPHP version 1.5 that is exploitable via the URL path to usersearch.php. The Connected documents corroborate NexusPHP 1.5 as affected, with the issue located in the usersearch.php path. There are no details here ...

CVE-2017-12777

CVE-2017-12777 is a confirmed Cross‑Site Scripting (XSS) vulnerability in NexusPHP v1.5. According to CNVD-2017-28416 and NVD details, a remote attacker can inject arbitrary web script or HTML by sending crafted parameters to the file usersearch.php, potentially affecting pages that render the vu...

CVE-2017-14347

NexusPHP 1.5.beta5.20120707 is affected by an XSS vulnerability in the returnto parameter of fun.php during a delete action. Descriptions in CVE records and CNVD/NVD references indicate the issue allows script injection in NexusPHP’s admin-facing flow, with CNVD noting potential to obtain the adm...