CVSS: 4.3EPSS: 1%CPEs: 1EXPL: 2CVE-2007-1519
https://notcve.org/view.php?id=CVE-2007-1519
Cross-site scripting (XSS) vulnerability in modules.php in PHP-Nuke 8.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the query parameter in a search operation in the Downloads module, a different product than CVE-2006-3948. Una vulnerabilidad de tipo Cross-site scripting (XSS) en el archivo modules.php en PHP-Nuke versión 8.0 y anteriores, permite que los atacantes remotos inyecten un script web o HTML arbitrario por medio del parámetro query en una operación search en el módulo Downloads, un producto diferente al CVE-2006- 3948. • http://phpfi.com/214668 http://secunia.com/advisories/24629 http://www.securityfocus.com/archive/1/462308/100/100/threaded http://www.ush.it/2007/03/09/php-nuke-wild-post-xss http://www.wisec.it/ush/phpnukexss.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.8EPSS: 2%CPEs: 13EXPL: 3CVE-2007-1520
https://notcve.org/view.php?id=CVE-2007-1520
The cross-site request forgery (CSRF) protection in PHP-Nuke 8.0 and earlier does not ensure the SERVER superglobal is an array before validating the HTTP_REFERER, which allows remote attackers to conduct CSRF attacks. La protección de cross-site request forgery (CSRF) en PHP-Nuke versión 8.0 y anteriores, no garantiza que la superglobal SERVER sea una matriz antes de validar la HTTP_REFERER, que permite a los atacantes remotos realizar ataques CSRF. • http://osvdb.org/34501 http://phpfi.com/214668 http://secunia.com/advisories/24629 http://www.securityfocus.com/archive/1/462308/100/100/threaded http://www.securityfocus.com/archive/1/462575/100/0/threaded http://www.securityfocus.com/archive/1/462727/100/0/threaded http://www.ush.it/2007/03/09/php-nuke-wild-post-xss http://www.wisec.it/ush/phpnukexss.html • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 4.3EPSS: 0%CPEs: 12EXPL: 0CVE-2007-1449
https://notcve.org/view.php?id=CVE-2007-1449
Directory traversal vulnerability in mainfile.php in PHP-Nuke 8.0 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the lang parameter. Vulnerabilidad de escalado de directorio en mainfile.php del PHP-Nuke 8.0 y versiones anteriores permite a atacantes remotos leer ficheros de su elección mediante un .. (punto punto) en el parámetro lang. • http://secunia.com/advisories/24484 http://www.securityfocus.com/archive/1/462443/100/0/threaded http://www.securityfocus.com/archive/1/462588/100/0/threaded http://www.securityfocus.com/bid/22909 •
CVSS: 7.5EPSS: 0%CPEs: 11EXPL: 0CVE-2007-1450
https://notcve.org/view.php?id=CVE-2007-1450
SQL injection vulnerability in mainfile.php in PHP-Nuke 8.0 and earlier allows remote attackers to execute arbitrary SQL commands in the Top or News module via the lang parameter. Vulnerabilidad de inyección SQL en el mainfile.php del PHP-Nuke 8.0 y versiones anteriores permite a atacantes remotos ejecutar comandos SQL de su elección en módulo Top o News mediante el parámetro lang. • http://www.securityfocus.com/archive/1/462443/100/0/threaded http://www.securityfocus.com/bid/22909 •
CVSS: 6.8EPSS: 89%CPEs: 1EXPL: 3CVE-2007-1061 – PHP-Nuke 8.0 Final - 'INSERT' Blind SQL Injection (MySQL)
https://notcve.org/view.php?id=CVE-2007-1061
SQL injection vulnerability in index.php in Francisco Burzi PHP-Nuke 8.0 Final and earlier, when the "HTTP Referers" block is enabled, allows remote attackers to execute arbitrary SQL commands via the HTTP Referer header (HTTP_REFERER variable). Vulnerabilidad de inyección SQL en index.php del Francisco Burzi PHP-Nuke 8.0 Final y versiones anteriores, cuando el bloque de las "Referencias HTTP" está habilitado, permite a atacantes remotos ejecutar comandos SQL de su elección mediante una cabecera HTTP Referer (variable HTTP_REFERER). • https://www.exploit-db.com/exploits/3344 https://www.exploit-db.com/exploits/3345 https://www.exploit-db.com/exploits/3346 http://lists.grok.org.uk/pipermail/full-disclosure/2007-February/052570.html http://osvdb.org/33316 http://secunia.com/advisories/24224 http://www.securityfocus.com/archive/1/461148/100/0/threaded http://www.securityfocus.com/bid/22638 http://www.vupen.com/english/advisories/2007/0673 https://exchange.xforce.ibmcloud.com/vulnerabilities/32607 •