CVE-2021-37770

CVE-2021-37770 affects Nucleus CMS v3.71. The issue is a file upload vulnerability that bypasses the intended upload controls by enabling an Htaccess file to be written to an AddType mapping (application/x-httpd-php.jpg), allowing the uploaded image to be treated as PHP and execute commands. This...

CVE-2015-5454

Nucleus CMS is affected by a cross-site scripting (XSS) vulnerability (CVE-2015-5454) in which remote attackers can inject arbitrary JavaScript/HTML through the title parameter when adding a new item. CNVD-2015-04422 and related NVD records document this issue for Nucleus CMS version 3.65. The ro...

CVE-2011-3760

CVE-2011-3760 affects Nucleus CMS 3.61, where remote attackers can trigger a direct request to a PHP file (e.g., xmlrpc/api_nucleus.inc.php) to disclose the installation path via an error message. The NVD and related records confirm this information disclosure vector and name the affected file pa...

CVE-2018-16636

CVE-2018-16636 affects Nucleus CMS 3.70, where an HTML injection vulnerability exists in the index.php body parameter. The root cause is improper handling of input leading to HTML injection, enabling an attacker to inject HTML into pages. The connected documents confirm the vulnerability’s existe...