Login Request a demo
Unscored severity · published Aug 8, 2007
CVE-2007-4212
Multiple cross-site scripting (XSS) vulnerabilities in the Search Module in PHP-Nuke allow remote attackers to inject arbitrary web script or HTML via a trailing "<" instead of a…
–
CVSS
1%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in the Search Module in PHP-Nuke allow remote attackers to inject arbitrary web script or HTML via a trailing "<" instead of a ">" in (1) the onerror attribute of an IMG element, (2) the onload attribute of an IFRAME element, or (3) redirect users to other sites via the META tag.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 64% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PH
Php-nuke · Phpnuke
7.0; 7.1; 7.2; 7.3; 7.4; 7.5; +5 more · source: NVD
Affected product
PH
Php-nuke
Phpnuke
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-4212
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-4212
osvdb.org
http://osvdb.org/42538
securityreason.com
http://securityreason.com/securityalert/2974
www.securityfocus.com
http://www.securityfocus.com/archive/1/475249/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/bid/25171
More from Php-nuke
9.8
CVE-2021-30177
There is a SQL Injection vulnerability in PHP-Nuke 8.3.3 in the User Registration section, leading to remote code execution
8.8
CVE-2004-1842
Cross-site request forgery (CSRF) vulnerability in Php-Nuke 6.x through 7.1.0 allows remote attackers to gain administrative privileges via an img tag with a URL to admin.php
7.5
CVE-2008-2020
The CAPTCHA implementation as used in (1) Francisco Burzi PHP-Nuke 7.0 and 8.1, (2) my123tkShop e-Commerce-Suite (aka 123tkShop) 0.9.1, (3) phpMyBitTorrent 1.2.2, (4) TorrentFlux…
–
CVE-2014-3934
SQL injection vulnerability in the Submit_News module for PHP-Nuke 8.3 allows remote attackers to execute arbitrary SQL commands via the topics[] parameter to modules.php
–
CVE-2010-5083
SQL injection vulnerability in the Web_Links module for PHP-Nuke 8.0 allows remote attackers to execute arbitrary SQL commands via the url parameter in an Add action to…