CVE-2006-5525

PHP-Nuke 7.9 and earlier are affected by an incomplete blacklist in mainfile.php that fails to reject UNION-based SQL injection payloads. The vulnerability can be triggered via the eid parameter in the Encyclopedia module (modules.php) using patterns such as //UNION or UNION/ /. The root cause is...

CVE-2011-3784

CVE-2011-3784 affects PHP-Nuke 8.0 and enables information disclosure by requesting a .php file, which then reveals the installation path in an error message (e.g., themes/Odyssey/theme.php). The root cause is error handling that leaks filesystem paths to remote attackers. Documented impact is se...

CVE-2005-1028

PHP-Nuke 6.x through 7.6 contains an information disclosure vulnerability where remote attackers can obtain sensitive information by directly requesting (1) index.php with the forum_admin parameter, (2) the Surveys module, or (3) the Your_Account module. The attack reveals the path in a PHP error...