CVE-2006-5494

CVE-2006-5494 / CVE-2006-6795 describe remote file inclusion flaws in the pandaBB module for PHP-Nuke and the My_eGallery 2.5.6 module for myPHPNuke, both allowing an attacker to execute arbitrary PHP code via a URL parameter. The core issue is PHP remote file inclusion in the gallery/displayCate...

CVE-2001-0899

CVE-2001-0899 concerns the PHP-Nuke Network Tools Add-On. The connected sources confirm that the vulnerability arises in Network Tools 0.2 for PHP-Nuke, where the remote attacker can execute commands on the server via shell metacharacters placed in the $hostinput variable. This leads to arbitrary...

CVE-2011-1480

CVE-2011-1480 affects PHP-Nuke (admin.php) in the admin backend of PHP-Nuke 8.0 and earlier. The vulnerability is an SQL injection via the chng_uid parameter, allowing remote attackers to execute arbitrary SQL commands. The available connected documents confirm the affected software/version range...

CVE-2008-6728

CVE-2008-6728 affects the PHP-Nuke Sections module, where an SQL injection is possible through the artid parameter in a printpage action to modules.php. The vulnerability arises from unsafely constructed SQL in the Sections module, enabling remote attackers to inject arbitrary SQL commands. The v...

CVE-2008-2020

The CVE-2008-2020 issue affects multiple CAPTCHA implementations: PHP-Nuke (versions 7.0–8.1), my123tkShop 0.9.1, phpMyBitTorrent 1.2.2, TorrentFlux 2.3, e107 0.7.11, WebZE 0.5.9, Open Media Collectors Database 1.5.0b4, and Labgab 1.1. The root cause is use of a code_bg.jpg background with PHP Im...

CVE-2009-1842

PHP-Nuke 8.0 is affected by a SQL injection in main/tracking/userLog.php that allows remote attackers to execute arbitrary SQL commands via the HTTP Referer header. Documented as CVE-2009-1842 with CVSS v2 base score 7.5 (network, low complexity, no auth). Affected product: PHP-Nuke; vulnerabilit...

CVE-2014-3934

CVE-2014-3934 is a SQL injection vulnerability in the Submit_News module of PHP-Nuke 8.3, exploitable via topics[] in modules.php to execute arbitrary SQL. Impact is partial confidentiality/integrity/availability. Exploitation details are supported by NVD/RedHat entries; CIRCL shows an exploit on...

CVE-2010-5083

CVE-2010-5083 : A SQL injection vulnerability exists in the Web_Links module of PHP-Nuke 8.0, allowing remote attackers to execute arbitrary SQL commands via the url parameter in an Add action to modules.php. The issue is caused by unsanitized input in that parameter, with potential partial confi...

CVE-2007-1450

The CVE-2007-1450 issue affects PHP-Nuke 8.0 and earlier, where an SQL injection flaw in mainfile.php enables remote attackers to execute arbitrary SQL commands in the Top or News module via the lang parameter. Affected component is the mainfile.php entry point used by the PHP-Nuke framework; roo...