Lucene search

K

10 matches found

CVE
CVE
added 2002/06/25 4:0 a.m.56 views

CVE-2001-0899

Network Tools 0.2 for PHP-Nuke allows remote attackers to execute commands on the server via shell metacharacters in the $hostinput variable.

7.5CVSS7.3AI score0.04404EPSS
CVE
CVE
added 2006/10/26 4:7 p.m.52 views

CVE-2006-5525

Incomplete blacklist vulnerability in mainfile.php in PHP-Nuke 7.9 and earlier allows remote attackers to conduct SQL injection attacks via (1) "//UNION " or (2) " UNION/ /" sequences, which are not rejected by the protection mechanism, as demonstrated by a SQL injection via the eid parameter in a ...

5.1CVSS7.9AI score0.01016EPSS
CVE
CVE
added 2011/06/21 2:52 a.m.49 views

CVE-2011-1480

SQL injection vulnerability in admin.php in the administration backend in Francisco Burzi PHP-Nuke 8.0 and earlier allows remote attackers to execute arbitrary SQL commands via the chng_uid parameter.

7.5CVSS8.7AI score0.0036EPSS
CVE
CVE
added 2005/05/10 4:0 a.m.41 views

CVE-2004-1842

Cross-site request forgery (CSRF) vulnerability in Php-Nuke 6.x through 7.1.0 allows remote attackers to gain administrative privileges via an img tag with a URL to admin.php.

8.8CVSS7.6AI score0.0059EPSS
CVE
CVE
added 2005/05/02 4:0 a.m.41 views

CVE-2005-1028

PHP-Nuke 6.x through 7.6 allows remote attackers to obtain sensitive information via a direct request to (1) index.php with the forum_admin parameter set, (2) the Surveys module, or (3) the Your_Account module, which reveals the path in a PHP error message.

5CVSS6.6AI score0.00346EPSS
CVE
CVE
added 2009/04/20 2:30 p.m.40 views

CVE-2008-6728

SQL injection vulnerability in the Sections module in PHP-Nuke, probably before 8.0, allows remote attackers to execute arbitrary SQL commands via the artid parameter in a printpage action to modules.php.

7.5CVSS8.6AI score0.0036EPSS
CVE
CVE
added 2011/06/21 2:52 a.m.39 views

CVE-2011-1482

Multiple cross-site request forgery (CSRF) vulnerabilities in mainfile.php in Francisco Burzi PHP-Nuke 8.0 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) add user accounts or (2) grant the administrative privilege to a user account, related t...

6.8CVSS7.5AI score0.00132EPSS
CVE
CVE
added 2011/06/21 2:52 a.m.37 views

CVE-2011-1481

Multiple cross-site scripting (XSS) vulnerabilities in Francisco Burzi PHP-Nuke 8.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) sender_name or (2) sender_email parameter in a Feedback action to modules.php.

4.3CVSS5.9AI score0.00254EPSS
CVE
CVE
added 2007/03/20 8:19 p.m.36 views

CVE-2007-1520

The cross-site request forgery (CSRF) protection in PHP-Nuke 8.0 and earlier does not ensure the SERVER superglobal is an array before validating the HTTP_REFERER, which allows remote attackers to conduct CSRF attacks.

6.8CVSS6.8AI score0.00506EPSS
CVE
CVE
added 2007/03/20 8:19 p.m.33 views

CVE-2007-1519

Cross-site scripting (XSS) vulnerability in modules.php in PHP-Nuke 8.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the query parameter in a search operation in the Downloads module, a different product than CVE-2006-3948.

4.3CVSS5.6AI score0.03175EPSS