CVSS: 7.5EPSS: 1%CPEs: 1EXPL: 0CVE-2006-5121
https://notcve.org/view.php?id=CVE-2006-5121
SQL injection vulnerability in modules/Downloads/admin.php in the Admin section of PostNuke 0.762 allows remote attackers to execute arbitrary SQL commands via the hits parameter. Vulnerabilidad de inyección SQL en modules/Downloads/admin.php en la sección Admin de PostNuke 0.762 permite a un atacante remoto ejecutar comandos SQL de su elección a través del parámetro hits. • http://community.postnuke.com/index.php?name=News&file=article&sid=2783 http://secunia.com/advisories/22197 http://securityreason.com/securityalert/1669 http://www.securityfocus.com/archive/1/447361/100/0/threaded http://www.securityfocus.com/bid/20317 http://www.vupen.com/english/advisories/2006/3886 https://exchange.xforce.ibmcloud.com/vulnerabilities/29271 •
CVSS: 5.1EPSS: 2%CPEs: 1EXPL: 1CVE-2006-0801 – PostNuke 0.6x/0.7x NS-Languages Module - 'language' SQL Injection
https://notcve.org/view.php?id=CVE-2006-0801
SQL injection vulnerability in the NS-Languages module for PostNuke 0.761 and earlier, when magic_quotes_gpc is off, allows remote attackers to execute arbitrary SQL commands via the language parameter to admin.php. • https://www.exploit-db.com/exploits/27255 http://archives.neohapsis.com/archives/fulldisclosure/2006-02/0469.html http://news.postnuke.com/index.php?name=News&file=article&sid=2754 http://secunia.com/advisories/18937 http://securityreason.com/securityalert/454 http://www.securityfocus.com/bid/16752 http://www.vupen.com/english/advisories/2006/0673 https://exchange.xforce.ibmcloud.com/vulnerabilities/24827 •
CVSS: 2.6EPSS: 0%CPEs: 19EXPL: 2CVE-2006-0800 – PostNuke 0.6x/0.7x NS-Languages Module - 'language' Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2006-0800
Interpretation conflict in PostNuke 0.761 and earlier allows remote attackers to conduct cross-site scripting (XSS) attacks via HTML tags with a trailing "<" character, which is interpreted as a ">" character by some web browsers but bypasses the blacklist protection in (1) the pnVarCleanFromInput function in pnAPI.php, (2) the pnSecureInput function in pnAntiCracker.php, and (3) the htmltext parameter in an edituser operation to user.php. • https://www.exploit-db.com/exploits/27254 http://archives.neohapsis.com/archives/fulldisclosure/2006-02/0469.html http://news.postnuke.com/index.php?name=News&file=article&sid=2754 http://secunia.com/advisories/18937 http://securityreason.com/securityalert/454 http://www.securityfocus.com/bid/16752 http://www.vupen.com/english/advisories/2006/0673 https://exchange.xforce.ibmcloud.com/vulnerabilities/24823 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 2.6EPSS: 0%CPEs: 1EXPL: 0CVE-2006-0802
https://notcve.org/view.php?id=CVE-2006-0802
Cross-site scripting (XSS) vulnerability in the NS-Languages module for PostNuke 0.761 and earlier, when magic_quotes_gpc is enabled, allows remote attackers to inject arbitrary web script or HTML via the language parameter in a missing or translation operation. • http://archives.neohapsis.com/archives/fulldisclosure/2006-02/0469.html http://news.postnuke.com/index.php?name=News&file=article&sid=2754 http://secunia.com/advisories/18937 http://securityreason.com/securityalert/454 http://www.securityfocus.com/bid/16752 http://www.vupen.com/english/advisories/2006/0673 https://exchange.xforce.ibmcloud.com/vulnerabilities/24823 •
CVSS: 7.5EPSS: 7%CPEs: 8EXPL: 6CVE-2006-0146 – Simplog 0.9.2 - 's' Remote Command Execution
https://notcve.org/view.php?id=CVE-2006-0146
The server.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle, (4) Cacti, (5) Xaraya, (6) PHPOpenChat, (7) MAXdev MD-Pro, and (8) MediaBeez, when the MySQL root password is empty, allows remote attackers to execute arbitrary SQL commands via the sql parameter. • https://www.exploit-db.com/exploits/1663 http://retrogod.altervista.org/phpopenchat_30x_sql_xpl.html http://secunia.com/advisories/17418 http://secunia.com/advisories/18233 http://secunia.com/advisories/18254 http://secunia.com/advisories/18260 http://secunia.com/advisories/18267 http://secunia.com/advisories/18276 http://secunia.com/advisories/18720 http://secunia.com/advisories/19555 http://secunia.com/advisories/19563 http://secunia.com/advisories/19590 http://secunia. • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •