9 matches found
CVE-2006-0800
CVE-2006-0800 affects PostNuke 0.761 and earlier. An interpretation conflict allows remote attackers to perform cross-site scripting (XSS) via HTML tags with a trailing “” while bypassing blacklist protections in pnVarCleanFromInput (pnAPI.php), pnSecureInput (pnAntiCracker.php), and the htmltext...
CVE-2005-1696
The CVE-2005-1696 entry applies to PostNuke, affecting versions 0.750 and 0.760RC3. It describes multiple cross-site scripting (XSS) vulnerabilities that allow remote attackers to inject arbitrary script/HTML via (1) the skin or (2) the paletteid parameter to demo.php in the Xanthia module, or (3...
CVE-2005-2689
CVE-2005-2689 covers multiple cross-site scripting (XSS) vulnerabilities in PostNuke 0.760-RC4b (and older). The issues allow remote attackers to inject arbitrary HTML/JavaScript via (1) the moderate parameter to the Comments module, and (2) htmltext parameter to html/user.php. The NVD record lis...
CVE-2001-1521
CVE-2001-1521 is an XSS vulnerability in PostNuke 0.64, specifically in the file/user component user.php , where the uname parameter can be exploited to inject arbitrary web script or HTML. The public records identify the affected software as PostNuke 0.64 and the vulnerability as a cross-site sc...
CVE-2005-1695
CVE-2005-1695 affects PostNuke RSS module (versions 0.750, 0.760RC2/RC3). The vulnerability is described as multiple cross-site scripting (XSS) flaws allowing remote injection of script/HTML via parameters: rss_url in magpie_slashbox.php and url in magpie_simple.php/magpie_debug.php. Connected Op...
CVE-2006-0802
CVE-2006-0802 is an XSS flaw in the NS-Languages module of PostNuke 0.761 and earlier, exploitable when magic_quotes_gpc is enabled. The vulnerability allows remote attackers to inject arbitrary web script or HTML via the language parameter during a missing or translation operation. Multiple conn...
CVE-2005-1778
CVE-2005-1778 describes a cross-site scripting (XSS) vulnerability in PostNuke 0.750, exploitable via the start parameter in readpmsg.php. The affected component is readpmsg.php within PostNuke, enabling remote attackers to inject arbitrary web script or HTML. The available connected documents co...
CVE-2005-1049
Summary: CVE-2005-1049 describes multiple cross-site scripting (XSS) vulnerabilities in PostNuke 0.760-RC3 (and related RC4 variants) where an attacker can inject arbitrary HTML/JavaScript via the module parameter to admin.php or the op parameter to user.php. The issue is noted to exist when the ...