CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 2CVE-2008-7226 – PHP-Nuke Recipe Module 1.3 - 'recipeid' SQL Injection
https://notcve.org/view.php?id=CVE-2008-7226
14 Sep 2009 — SQL injection vulnerability in index.php in the Recipes module 1.3, 1.4, and possibly other versions for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the recipeid parameter. Vulnerabilidad de inyección SQL en index.php en el módulo Recipes v1.3, v1.4, y posiblemente otras versiones para PHP Nuke, permite a atacantes remotos ejecutar comandos SQL de su elección a través del parámetro "recipeid". • https://www.exploit-db.com/exploits/31287 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 1CVE-2008-6865
https://notcve.org/view.php?id=CVE-2008-6865
14 Jul 2009 — SQL injection vulnerability in modules.php in the Sectionsnew module for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the artid parameter in a printpage action. Vulnerabilidad de inyección de SQL en modules.php en el módulo Sectionsnew para PHP-Nuke permite a atacantes remotos ejecutar comandos SQL de su elección a través del parámetro artid en una acción printpage. • http://osvdb.org/51890 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 1%CPEs: 3EXPL: 2CVE-2008-5039 – PHP-Nuke Nuke League Module - 'tid' Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2008-5039
12 Nov 2008 — Cross-site scripting (XSS) vulnerability in the League module for PHP-Nuke, possibly 2.4, allows remote attackers to inject arbitrary web script or HTML via the tid parameter in a team action to modules.php. Vulnerabilidad de secuencias de comandos de sitios cruzados (XSS) en el módulo League para PHP-Nuke, puede que en v2.4; permite a atacantes remotos inyectar secuencias de comandos Web o HTML de su elección a través del parámetro tid en una acción de equipo en modules.php. • https://www.exploit-db.com/exploits/32538 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 2%CPEs: 2EXPL: 1CVE-2008-4767 – PHP-Nuke DownloadsPlus Module - Arbitrary File Upload
https://notcve.org/view.php?id=CVE-2008-4767
28 Oct 2008 — Unrestricted file upload vulnerability in the DownloadsPlus module in PHP-Nuke allows remote attackers to execute arbitrary code by uploading a file with (1) .htm, (2) .html, or (3) .txt extensions, then accessing it via a direct request to the file. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: it is unclear how allowing the upload of .html or .txt files supports arbitrary code execution; this might be legitimate functionality. Vuln... • https://www.exploit-db.com/exploits/31702 • CWE-20: Improper Input Validation •
CVSS: 9.1EPSS: 1%CPEs: 2EXPL: 3CVE-2008-3573 – Pligg CMS 9.9.5 - 'CAPTCHA' Registration Automation Security Bypass
https://notcve.org/view.php?id=CVE-2008-3573
10 Aug 2008 — The CAPTCHA implementation in (1) Pligg 9.9.5 and possibly (2) Francisco Burzi PHP-Nuke 8.1 provides a critical random number (the ts_random value) within the URL in the SRC attribute of an IMG element, which allows remote attackers to pass the CAPTCHA test via a calculation that combines this value with the current date and the HTTP User-Agent string. La implementación CAPTCHA en (1) Pligg 9.9.5 y posiblemente (2) Francisco Burzi PHP-Nuke 8.1, proporciona un número aleatorio crítico (el valor del ts_random... • https://www.exploit-db.com/exploits/32142 • CWE-189: Numeric Errors CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 2CVE-2008-0906 – PHP-Nuke Module Docum - 'artid' SQL Injection
https://notcve.org/view.php?id=CVE-2008-0906
22 Feb 2008 — SQL injection vulnerability in the Docum module in PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the artid parameter in a viewarticle operation. Vulnerabilidad de inyección SQL en el módulo Docum de PHP-Nuke permite a atacantes remotos ejecutar comandos SQL de su elección a través del parámetro artid en una operación viewarticle. • https://www.exploit-db.com/exploits/5161 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •