CVE-2006-0800

CVE-2006-0800 affects PostNuke 0.761 and earlier. An interpretation conflict allows remote attackers to perform cross-site scripting (XSS) via HTML tags with a trailing “” while bypassing blacklist protections in pnVarCleanFromInput (pnAPI.php), pnSecureInput (pnAntiCracker.php), and the htmltext...

CVE-2005-2690

CVE-2005-2690 : PostNuke 0.760-RC4b is affected in the Downloads module. The vulnerability is a SQL injection in the dl-viewdownload.php script triggered via the show parameter, allowing an attacker to modify or execute SQL commands. Some sources indicate exploitation requires admin rights and co...

CVE-2005-2689

CVE-2005-2689 covers multiple cross-site scripting (XSS) vulnerabilities in PostNuke 0.760-RC4b (and older). The issues allow remote attackers to inject arbitrary HTML/JavaScript via (1) the moderate parameter to the Comments module, and (2) htmltext parameter to html/user.php. The NVD record lis...

CVE-2006-6233

The CVE refers to an SQL injection in the Downloads module of PostNuke (unknown versions). The vulnerability is triggered by the lid parameter in a viewdownloaddetails operation, potentially arising from the viewdownloaddetails function in dl-downloaddetails.php. Impact is partial confidentiality...