CVSS: 6.1EPSS: 0%CPEs: 15EXPL: 6CVE-2004-2293 – PHP-Nuke 6.x/7.x Encyclopedia Module - Multiple Function Cross-Site Scripting Vulnerabilities
https://notcve.org/view.php?id=CVE-2004-2293
31 Dec 2004 — Multiple cross-site scripting (XSS) vulnerabilities in PHP-Nuke 6.0 to 7.3 allow remote attackers to inject arbitrary web script or HTML via the (1) eid parameter or (2) query parameter to the Encyclopedia module, (3) preview_review function in the Reviews module as demonstrated by the url, cover, rlanguage, and hits parameters, or (4) savecomment function in the Reviews module, as demonstrated using the uname parameter. NOTE: the Faq/categories and Encyclopedia/ltr issues are already covered by CVE-2005-10... • https://www.exploit-db.com/exploits/24191 •
CVSS: 6.1EPSS: 0%CPEs: 15EXPL: 4CVE-2004-2294 – PHP-Nuke 6.x/7.x Reviews Module - Multiple Cross-Site Scripting Vulnerabilities
https://notcve.org/view.php?id=CVE-2004-2294
31 Dec 2004 — Canonicalize-before-filter error in the send_review function in the Reviews module for PHP-Nuke 6.0 to 7.3 allows remote attackers to inject arbitrary web script or HTML via hex-encoded XSS sequences in the text parameter, which is checked for dangerous sequences before it is canonicalized, leading to a cross-site scripting (XSS) vulnerability. • https://www.exploit-db.com/exploits/24194 •
CVSS: 9.8EPSS: 0%CPEs: 15EXPL: 4CVE-2004-2295 – PHP-Nuke 6.x/7.x Reviews Module - 'order' SQL Injection
https://notcve.org/view.php?id=CVE-2004-2295
31 Dec 2004 — SQL injection vulnerability in the Reviews module in PHP-Nuke 6.0 to 7.3 allows remote attackers to execute arbitrary SQL commands via the order parameter. • https://www.exploit-db.com/exploits/24192 •
CVSS: 7.5EPSS: 0%CPEs: 15EXPL: 4CVE-2004-2297 – PHP-Nuke 6.x/7.x - Multiple Input Validation Vulnerabilities
https://notcve.org/view.php?id=CVE-2004-2297
31 Dec 2004 — The Reviews module in PHP-Nuke 6.0 to 7.3 allows remote attackers to cause a denial of service (CPU and memory consumption) via a large, out-of-range score parameter. • https://www.exploit-db.com/exploits/24193 •
CVSS: 9.1EPSS: 1%CPEs: 28EXPL: 2CVE-2004-2044 – PHP-Nuke 5.x/6.x/7.x - Direct Script Access Security Bypass
https://notcve.org/view.php?id=CVE-2004-2044
01 Jun 2004 — PHP-Nuke 7.3, and other products that use the PHP-Nuke codebase such as the Nuke Cops betaNC PHP-Nuke Bundle, OSCNukeLite 3.1, and OSC2Nuke 7x do not properly use the eregi() PHP function with $_SERVER['PHP_SELF'] to identify the calling script, which allows remote attackers to directly access scripts, obtain path information via a PHP error message, and possibly gain access, as demonstrated using an HTTP request that contains the "admin.php" string. • https://www.exploit-db.com/exploits/24166 •
CVSS: 7.5EPSS: 0%CPEs: 9EXPL: 1CVE-2004-1998
https://notcve.org/view.php?id=CVE-2004-1998
05 May 2004 — The Downloads module in Php-Nuke 6.x through 7.2 allows remote attackers to gain sensitive information via an invalid show parameter to modules.php, which reveals the full path in a PHP error message. • http://marc.info/?l=bugtraq&m=108378804809891&w=2 •
CVSS: 6.1EPSS: 0%CPEs: 9EXPL: 2CVE-2004-1999
https://notcve.org/view.php?id=CVE-2004-1999
05 May 2004 — Cross-site scripting (XSS) vulnerability in the Downloads module in Php-Nuke 6.x through 7.2 allows remote attackers to inject arbitrary HTML and web script via the (1) ttitle or (2) sid parameters to modules.php. • http://marc.info/?l=bugtraq&m=108378804809891&w=2 •
CVSS: 9.8EPSS: 2%CPEs: 14EXPL: 2CVE-2004-2000 – PHP-Nuke Downloads Module - 'sid' SQL Injection
https://notcve.org/view.php?id=CVE-2004-2000
05 May 2004 — SQL injection vulnerability in the Downloads module in Php-Nuke 6.x through 7.2 allows remote attackers to execute arbitrary SQL via the (1) orderby or (2) sid parameters to modules.php. • https://www.exploit-db.com/exploits/31283 •
CVSS: 9.8EPSS: 0%CPEs: 15EXPL: 4CVE-2004-1929 – PHP-Nuke 6.x/7.x - Multiple SQL Injections
https://notcve.org/view.php?id=CVE-2004-1929
13 Apr 2004 — SQL injection vulnerability in the bblogin function in functions.php in PHP-Nuke 6.x through 7.2 allows remote attackers to bypass authentication and gain access by injecting base64-encoded SQL code into the user parameter. • https://www.exploit-db.com/exploits/23998 •
CVSS: 9.8EPSS: 0%CPEs: 14EXPL: 2CVE-2004-1932 – PHP-Nuke - SQL Injection Edit/Save Messages
https://notcve.org/view.php?id=CVE-2004-1932
12 Apr 2004 — SQL injection vulnerability in (1) auth.php and (2) admin.php in PHP-Nuke 6.x through 7.2 allows remote attackers to execute arbitrary SQL code and create an administrator account via base64-encoded SQL in the admin parameter. • https://www.exploit-db.com/exploits/465 •