PH
Product
Php-nuke
94
CVEs
0
On KEV
–
Max CVSS
0
New 30D
Severity mix
Critical 0High 0Medium 0Low 0
Watch
Add Php-nuke to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2004-0732 | – | Jul 27 | SQL injection vulnerability in index.php in the Search module for Php-Nuke allows remote attackers to execute arbitrary SQL statements via the instory parameter Affected: 8.0_final |
| CVE-2004-0731 | – | Jul 27 | Cross-site scripting (XSS) vulnerability in index.php in the Search module for Php-Nuke allows remote attackers to inject arbitrary script as other users via the input field Affected: 8.0_final |
| CVE-2004-2044 | – | Jun 1 | PHP-Nuke 7.3, and other products that use the PHP-Nuke codebase such as the Nuke Cops betaNC PHP-Nuke Bundle, OSCNukeLite 3.1, and OSC2Nuke 7x do not properly use the eregi() PHP… Affected: 5.0; 5.0.1; 5.1; 5.2; 5.2a; 5.3.1; +18 more |
| CVE-2004-1998 | – | May 5 | The Downloads module in Php-Nuke 6.x through 7.2 allows remote attackers to gain sensitive information via an invalid show parameter to modules.php, which reveals the full path in… Affected: 6.0; 6.5; 6.6; 6.7; 6.8; 6.9; +3 more |
| CVE-2004-1999 | – | May 5 | Cross-site scripting (XSS) vulnerability in the Downloads module in Php-Nuke 6.x through 7.2 allows remote attackers to inject arbitrary HTML and web script via the (1) ttitle or… Affected: 6.0; 6.5; 6.6; 6.7; 6.8; 6.9; +3 more |
| CVE-2004-1984 | – | May 2 | Coppermine Photo Gallery 1.2.2b and 1.2.0 RC4 allows remote attackers to obtain sensitive information via a direct HTTP request to (1) phpinfo.php, (2) addpic.php, (3) config.php,… Affected: 6.9; 7.0; 7.0_final; 7.1; 7.2 |
| CVE-2004-1987 | – | Apr 30 | picmgmtbatch.inc.php in Coppermine Photo Gallery 1.2.2b and 1.2.0 RC4 allows remote attackers with administrative privileges to execute arbitrary commands via shell metacharacters… Affected: 6.9; 7.0; 7.0_final; 7.1; 7.2 |
| CVE-2004-1989 | – | Apr 30 | PHP remote file inclusion vulnerability in theme.php in Coppermine Photo Gallery 1.2.2b allows remote attackers to execute arbitrary PHP code by modifying the THEME_DIR parameter… Affected: 6.9; 7.0; 7.0_final; 7.1; 7.2 |
| CVE-2004-1988 | – | Apr 30 | PHP remote file inclusion vulnerability in init.inc.php in Coppermine Photo Gallery 1.2.0 RC4 allows remote attackers to execute arbitrary PHP code by modifying the CPG_M_DIR to… Affected: 6.9; 7.0; 7.0_final; 7.1; 7.2 |
| CVE-2004-1985 | – | Apr 30 | Cross-site scripting (XSS) vulnerability in menu.inc.php in Coppermine Photo Gallery 1.2.2b allows remote attackers to inject arbitrary HTML or web script via the CPG_URL… Affected: 6.9; 7.0; 7.0_final; 7.1; 7.2 |
| CVE-2004-1972 | – | Apr 26 | SQL injection vulnerability in modules.php in PHP-Nuke Video Gallery Module 0.1 Beta 5 allows remote attackers to execute arbitrary SQL code via the (1) clipid or (2) catid… Affected: 7.2 |
| CVE-2004-1929 | – | Apr 13 | SQL injection vulnerability in the bblogin function in functions.php in PHP-Nuke 6.x through 7.2 allows remote attackers to bypass authentication and gain access by injecting… Affected: 5.5; 6.0; 6.5; 6.5_beta1; 6.5_final; 6.5_rc1; +9 more |
| CVE-2004-1930 | – | Apr 12 | Cross-site scripting (XSS) vulnerability in the cookiedecode function in mainfile.php for PHP-Nuke 6.x through 7.2, when themes are used, allows remote attackers to inject… Affected: 6.0; 6.5; 6.5_beta1; 6.5_final; 6.5_rc1; 6.5_rc2; +8 more |
| CVE-2004-1932 | – | Apr 12 | SQL injection vulnerability in (1) auth.php and (2) admin.php in PHP-Nuke 6.x through 7.2 allows remote attackers to execute arbitrary SQL code and create an administrator account… Affected: 6.0; 6.5; 6.5_beta1; 6.5_final; 6.5_rc1; 6.5_rc2; +8 more |
| CVE-2004-1986 | – | Apr 4 | Directory traversal vulnerability in modules.php in Coppermine Photo Gallery 1.2.2b and 1.2.0 RC4 allows remote attackers with administrative privileges to read arbitrary files… Affected: 6.9; 7.0; 7.0_final; 7.1; 7.2 |
| CVE-2004-1840 | – | Mar 22 | Multiple cross-site scripting (XSS) vulnerabilities in MS Analysis module 2.0 for PHP-Nuke allows remote attackers to inject arbitrary web script or HTML via the (1) screen… Affected: 6.5; 6.5_beta1; 6.5_final; 6.5_rc1; 6.5_rc2; 6.5_rc3; +5 more |
| CVE-2004-1839 | – | Mar 22 | MS Analysis module 2.0 for PHP-Nuke allows remote attackers to obtain sensitive information via a direct request to (1) browsers.php, (2) mstrack.php, or (3) title.php, which… Affected: 6.5; 6.5_beta1; 6.5_final; 6.5_rc1; 6.5_rc2; 6.5_rc3; +5 more |
| CVE-2004-1830 | – | Mar 18 | error.php in Error Manager 2.1 for PHP-Nuke 6.0 allows remote attackers to obtain sensitive information via an invalid (1) language, (2) newlang, or (3) lang parameter, which… Affected: 6.0 |
| CVE-2004-1817 | – | Mar 15 | Cross-site scripting (XSS) vulnerability in modules.php in Php-Nuke 7.1.0 allows remote attackers to inject arbitrary web script or HTML via the (1) Your Name field, (2) e-mail… Affected: 7.1 |
| CVE-2003-1210 | – | Dec 31 | Multiple SQL injection vulnerabilities in the Downloads module for PHP-Nuke 5.x through 6.5 allow remote attackers to execute arbitrary SQL commands via the (1) lid parameter to… Affected: through 6.5; 6.5_beta1; 6.5_final; 6.5_rc1; 6.5_rc2; 6.5_rc3 |
| CVE-2003-1547 | – | Dec 31 | Cross-site scripting (XSS) vulnerability in block-Forums.php in the Splatt Forum module for PHP-Nuke 6.x allows remote attackers to inject arbitrary web script or HTML via the… Affected: 6.5; 6.5_beta1; 6.5_rc1; 6.5_rc2; 6.5_rc3 |
| CVE-2003-1526 | – | Dec 31 | PHP-Nuke 7.0 allows remote attackers to obtain the installation path via certain characters such as (1) ", (2) ', or (3) > in the search field, which reveals the path in an error… Affected: 7.0 |
| CVE-2003-1468 | – | Dec 31 | The Web_Links module in PHP-Nuke 6.0 through 6.5 final allows remote attackers to obtain the full web server path via an invalid cid parameter that is non-numeric or null, which… Affected: 6.0; 6.5; 6.5_beta1; 6.5_final; 6.5_rc1; 6.5_rc2; +1 more |
| CVE-2003-1435 | – | Dec 31 | SQL injection vulnerability in PHP-Nuke 5.6 and 6.0 allows remote attackers to execute arbitrary SQL commands via the days parameter to the search module Affected: 5.6; 6.0 |
| CVE-2003-1400 | – | Dec 31 | Cross-site scripting (XSS) vulnerability in the Your_Account module for PHP-Nuke 5.0 through 6.0 allows remote attackers to inject arbitrary web script or HTML via the user_avatar… Affected: 5.0; 5.0.1; 5.1; 5.2; 5.2a; 5.3.1; +4 more |
| CVE-2003-0279 | – | Jun 16 | Multiple SQL injection vulnerabilities in the Web_Links module for PHP-Nuke 5.x through 6.5 allows remote attackers to steal sensitive information via numeric fields, as… Affected: 5.0; 6.0 |
| CVE-2003-0318 | – | Jun 9 | Cross-site scripting (XSS) vulnerability in the Statistics module for PHP-Nuke 6.0 and earlier allows remote attackers to insert arbitrary web script via the year parameter Affected: through 6.0 |
| CVE-2002-2032 | – | Dec 31 | sql_layer.php in PHP-Nuke 5.4 and earlier does not restrict access to debugging features, which allows remote attackers to gain SQL query information by setting the sql_debug… Affected: 1.0; 2.5; 3.0; 4.0; 4.3; 4.4; +8 more |
| CVE-2002-1803 | – | Dec 31 | Cross-site scripting (XSS) vulnerability in PHP-Nuke 6.0 allows remote attackers to inject arbitrary web script or HTML via Javascript in an IMG tag Affected: 6.0 |
| CVE-2002-1242 | – | Nov 12 | SQL injection vulnerability in PHP-Nuke before 6.0 allows remote authenticated users to modify the database and gain privileges via the "bio" argument to modules.php Affected: 5.6 |
| CVE-2002-0483 | – | Aug 12 | index.php for PHP-Nuke 5.4 and earlier allows remote attackers to determine the physical pathname of the web server when the file parameter is set to index.php, which triggers an… Affected: 5.0; 5.0.1; 5.1; 5.2; 5.2a; 5.3.1; +1 more |
| CVE-2002-0206 | – | May 16 | index.php in Francisco Burzi PHP-Nuke 5.3.1 and earlier, and possibly other versions before 5.5, allows remote attackers to execute arbitrary PHP code by specifying a URL to the… Affected: 1.0; 2.5; 3.0; 4.0; 4.3; 4.4; +7 more |
| CVE-2001-1524 | – | Dec 31 | Cross-site scripting (XSS) vulnerability in PHP-Nuke 5.3.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) uname parameter in user.php, (2)… Affected: 3.0; 4.0; 4.3; 4.4; 4.4.1a; 5.0; +5 more |
| CVE-2001-1522 | – | Dec 31 | Cross-site scripting (XSS) vulnerability in im.php in IMessenger for PHP-Nuke allows remote attackers to inject arbitrary web script or HTML via a message Affected: 8.0_final |
| CVE-2001-0854 | – | Dec 6 | PHP-Nuke 5.2 allows remote attackers to copy and delete arbitrary files by calling case.filemanager.php with admin.php as an argument, which sets the $PHP_SELF variable and makes… Affected: 5.2 |
| CVE-2001-0911 | – | Nov 21 | PHP-Nuke 5.1 stores user and administrator passwords in a base-64 encoded cookie, which could allow remote attackers to gain privileges by stealing or sniffing the cookie and… Affected: 5.1; 5.2; 5.3.1 |
| CVE-2001-1032 | – | Sep 24 | admin.php in PHP-Nuke 5.2 and earlier, except 5.0RC1, does not check login credentials for upload operations, which allows remote attackers to copy and upload arbitrary files and… Affected: through 5.2 |
| CVE-2001-1025 | – | Aug 31 | PHP-Nuke 5.x allows remote attackers to perform arbitrary SQL operations by modifying the "prefix" variable when calling any scripts that do not already define the prefix variable… Affected: 5.0; 5.0.1 |
| CVE-2001-0383 | – | Jun 18 | banners.php in PHP-Nuke 4.4 and earlier allows remote attackers to modify banner ad URLs by directly calling the Change operation, which does not require authentication Affected: through 4.4 |
| CVE-2001-0001 | – | Jun 2 | cookiedecode function in PHP-Nuke 4.4 allows users to bypass authentication and gain access to other user accounts by extracting the authentication information from a cookie Affected: 4.4 |
| CVE-2001-0320 | – | May 3 | bb_smilies.php and bbcode_ref.php in PHP-Nuke 4.4 allows remote attackers to read arbitrary files and gain PHP administrator privileges by inserting a null character and Affected: 4.0.4; 4.4 |
| CVE-2001-0321 | – | May 3 | opendir.php script in PHP-Nuke allows remote attackers to read arbitrary files by specifying the filename as an argument to the requesturl parameter Affected: 8.0_final |
| CVE-2001-0292 | – | May 3 | PHP-Nuke 4.4.1a allows remote attackers to modify a user's email address and obtain the password by guessing the user id (UID) and calling user.php with the saveuser operator Affected: 4.4.1a |
| CVE-2000-0745 | – | Oct 20 | admin.php3 in PHP-Nuke does not properly verify the PHP-Nuke administrator password, which allows remote attackers to gain privileges by requesting a URL that does not specify the… Affected: 1.0; 2.5 |