CVSS: 6.1EPSS: 0%CPEs: 15EXPL: 4CVE-2004-2294 – PHP-Nuke 6.x/7.x Reviews Module - Multiple Cross-Site Scripting Vulnerabilities
https://notcve.org/view.php?id=CVE-2004-2294
31 Dec 2004 — Canonicalize-before-filter error in the send_review function in the Reviews module for PHP-Nuke 6.0 to 7.3 allows remote attackers to inject arbitrary web script or HTML via hex-encoded XSS sequences in the text parameter, which is checked for dangerous sequences before it is canonicalized, leading to a cross-site scripting (XSS) vulnerability. • https://www.exploit-db.com/exploits/24194 •
CVSS: 9.8EPSS: 0%CPEs: 15EXPL: 4CVE-2004-2295 – PHP-Nuke 6.x/7.x Reviews Module - 'order' SQL Injection
https://notcve.org/view.php?id=CVE-2004-2295
31 Dec 2004 — SQL injection vulnerability in the Reviews module in PHP-Nuke 6.0 to 7.3 allows remote attackers to execute arbitrary SQL commands via the order parameter. • https://www.exploit-db.com/exploits/24192 •
CVSS: 5.3EPSS: 0%CPEs: 15EXPL: 3CVE-2004-2296
https://notcve.org/view.php?id=CVE-2004-2296
31 Dec 2004 — The preview_review function in the Reviews module in PHP-Nuke 6.0 to 7.3, when running on Windows systems, allows remote attackers to obtain sensitive information via an invalid date parameter, which generates an error message. • http://secunia.com/advisories/11852 •
CVSS: 7.5EPSS: 0%CPEs: 15EXPL: 4CVE-2004-2297 – PHP-Nuke 6.x/7.x - Multiple Input Validation Vulnerabilities
https://notcve.org/view.php?id=CVE-2004-2297
31 Dec 2004 — The Reviews module in PHP-Nuke 6.0 to 7.3 allows remote attackers to cause a denial of service (CPU and memory consumption) via a large, out-of-range score parameter. • https://www.exploit-db.com/exploits/24193 •
CVSS: 9.1EPSS: 1%CPEs: 28EXPL: 2CVE-2004-2044 – PHP-Nuke 5.x/6.x/7.x - Direct Script Access Security Bypass
https://notcve.org/view.php?id=CVE-2004-2044
01 Jun 2004 — PHP-Nuke 7.3, and other products that use the PHP-Nuke codebase such as the Nuke Cops betaNC PHP-Nuke Bundle, OSCNukeLite 3.1, and OSC2Nuke 7x do not properly use the eregi() PHP function with $_SERVER['PHP_SELF'] to identify the calling script, which allows remote attackers to directly access scripts, obtain path information via a PHP error message, and possibly gain access, as demonstrated using an HTTP request that contains the "admin.php" string. • https://www.exploit-db.com/exploits/24166 •
CVSS: 7.5EPSS: 0%CPEs: 9EXPL: 1CVE-2004-1998
https://notcve.org/view.php?id=CVE-2004-1998
05 May 2004 — The Downloads module in Php-Nuke 6.x through 7.2 allows remote attackers to gain sensitive information via an invalid show parameter to modules.php, which reveals the full path in a PHP error message. • http://marc.info/?l=bugtraq&m=108378804809891&w=2 •
CVSS: 6.1EPSS: 0%CPEs: 9EXPL: 2CVE-2004-1999
https://notcve.org/view.php?id=CVE-2004-1999
05 May 2004 — Cross-site scripting (XSS) vulnerability in the Downloads module in Php-Nuke 6.x through 7.2 allows remote attackers to inject arbitrary HTML and web script via the (1) ttitle or (2) sid parameters to modules.php. • http://marc.info/?l=bugtraq&m=108378804809891&w=2 •
CVSS: 9.8EPSS: 2%CPEs: 14EXPL: 2CVE-2004-2000 – PHP-Nuke Downloads Module - 'sid' SQL Injection
https://notcve.org/view.php?id=CVE-2004-2000
05 May 2004 — SQL injection vulnerability in the Downloads module in Php-Nuke 6.x through 7.2 allows remote attackers to execute arbitrary SQL via the (1) orderby or (2) sid parameters to modules.php. • https://www.exploit-db.com/exploits/31283 •
CVSS: 9.8EPSS: 0%CPEs: 15EXPL: 4CVE-2004-1929 – PHP-Nuke 6.x/7.x - Multiple SQL Injections
https://notcve.org/view.php?id=CVE-2004-1929
13 Apr 2004 — SQL injection vulnerability in the bblogin function in functions.php in PHP-Nuke 6.x through 7.2 allows remote attackers to bypass authentication and gain access by injecting base64-encoded SQL code into the user parameter. • https://www.exploit-db.com/exploits/23998 •
CVSS: 6.1EPSS: 0%CPEs: 14EXPL: 3CVE-2004-1930 – PHP-Nuke 6.x/7.x - CookieDecode Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2004-1930
12 Apr 2004 — Cross-site scripting (XSS) vulnerability in the cookiedecode function in mainfile.php for PHP-Nuke 6.x through 7.2, when themes are used, allows remote attackers to inject arbitrary web script or HTML via a base64-encoded user parameter or cookie. • https://www.exploit-db.com/exploits/23990 •