PO
Product
Postnuke
38
CVEs
0
On KEV
–
Max CVSS
0
New 30D
Severity mix
Critical 0High 0Medium 0Low 0
Watch
Add Postnuke to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2007-0384 | – | Jan 19 | Cross-site scripting (XSS) vulnerability in preview in the reviews section in PostNuke 0.764 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors Affected: 0.764 |
| CVE-2007-0386 | – | Jan 19 | Unspecified vulnerability in the rating section in PostNuke 0.764 has unknown impact and attack vectors, related to "an interesting bug." Affected: 0.764 |
| CVE-2007-0385 | – | Jan 19 | The faq section in PostNuke 0.764 allows remote attackers to obtain sensitive information (the full path) via "unvalidated output" in FAQ/index.php, possibly involving an… Affected: 0.764 |
| CVE-2006-6267 | – | Dec 4 | PostNuke 0.7.5.0, and certain minor versions, allows remote attackers to obtain sensitive information via a non-numeric value of the stop parameter, which reveals the path in an… Affected: 0.7.5.0 |
| CVE-2006-6233 | – | Dec 2 | SQL injection vulnerability in the Downloads module for unknown versions of PostNuke allows remote attackers to execute arbitrary SQL commands via the lid parameter in a… Affected: 0.76_rc4; 0.76_rc4a; 0.76_rc4b; 0.760_rc2; 0.760_rc3; 0.760_rc4; +4 more |
| CVE-2006-5733 | – | Nov 6 | Directory traversal vulnerability in error.php in PostNuke 0.763 and earlier allows remote attackers to include and execute arbitrary local files via a Affected: through 0.763; 0.762 |
| CVE-2006-5121 | – | Oct 3 | SQL injection vulnerability in modules/Downloads/admin.php in the Admin section of PostNuke 0.762 allows remote attackers to execute arbitrary SQL commands via the hits parameter Affected: 0.762 |
| CVE-2006-0801 | – | Feb 20 | SQL injection vulnerability in the NS-Languages module for PostNuke 0.761 and earlier, when magic_quotes_gpc is off, allows remote attackers to execute arbitrary SQL commands via… Affected: through 0.761 |
| CVE-2006-0802 | – | Feb 20 | Cross-site scripting (XSS) vulnerability in the NS-Languages module for PostNuke 0.761 and earlier, when magic_quotes_gpc is enabled, allows remote attackers to inject arbitrary… Affected: through 0.761 |
| CVE-2006-0800 | – | Feb 20 | Interpretation conflict in PostNuke 0.761 and earlier allows remote attackers to conduct cross-site scripting (XSS) attacks via HTML tags with a trailing "<" character, which is… Affected: 0.7; 0.62; 0.63; 0.64; 0.70; 0.71; +13 more |
| CVE-2006-0147 | – | Jan 9 | Dynamic code evaluation vulnerability in tests/tmssql.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle,… Affected: 0.761 |
| CVE-2006-0146 | – | Jan 9 | The server.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle, (4) Cacti, (5) Xaraya, (6) PHPOpenChat, (7)… Affected: 0.761 |
| CVE-2005-2690 | – | Aug 24 | SQL injection vulnerability in the Downloads module in PostNuke 0.760-RC4b allows PostNuke administrators to execute arbitrary SQL commands via the show parameter to… Affected: 0.76_rc4b |
| CVE-2005-2689 | – | Aug 24 | Multiple cross-site scripting (XSS) vulnerabilities in PostNuke 0.760-RC4b allows remote attackers to inject arbitrary web script or HTML via (1) the moderate parameter to the… Affected: 0.76_rc4b |
| CVE-2005-1778 | – | May 31 | Cross-site scripting (XSS) vulnerability in readpmsg.php in PostNuke 0.750 allows remote attackers to inject arbitrary web script or HTML via the start parameter Affected: 0.750 |
| CVE-2005-1777 | – | May 31 | SQL injection vulnerability in readpmsg.php in PostNuke 0.750 allows remote attackers to execute arbitrary SQL commands via the start parameter Affected: 0.750 |
| CVE-2005-1696 | – | May 24 | Multiple cross-site scripting (XSS) vulnerabilities in PostNuke 0.750 and 0.760RC3 allow remote attackers to inject arbitrary web script or HTML via the (1) skin or (2) paletteid… Affected: 0.750; 0.760_rc3 |
| CVE-2005-1694 | – | May 24 | Multiple SQL injection vulnerabilities in Xanthia.php in the Xanthia module in PostNuke 0.750 allow remote attackers to execute arbitrary SQL commands via the (1) name or (2)… Affected: 0.750 |
| CVE-2005-1695 | – | May 24 | Multiple cross-site scripting (XSS) vulnerabilities in the RSS module in PostNuke 0.750 and 0.760RC2 and RC3 allow remote attackers to inject arbitrary web script or HTML via the… Affected: 0.750; 0.760_rc2; 0.760_rc3 |
| CVE-2005-1699 | – | May 24 | Directory traversal vulnerability in pnadminapi.php in the Xanthia module in PostNuke 0.760-RC3 allows remote administrators to read arbitrary files via a Affected: 0.760_rc3 |
| CVE-2005-1700 | – | May 24 | SQL injection vulnerability in pnadmin.php in the Xanthia module in PostNuke 0.760-RC3 allows remote administrators to execute arbitrary SQL commands via the riga[0] parameter Affected: 0.760_rc3 |
| CVE-2005-1621 | – | May 16 | Directory traversal vulnerability in the pnModFunc function in pnMod.php for PostNuke 0.750 through 0.760rc4 allows remote attackers to read arbitrary files via a Affected: 0.750; 0.760_rc2; 0.760_rc3; 0.760_rc4 |
| CVE-2005-0615 | – | May 2 | Multiple SQL injection vulnerabilities in (1) index.php, (2) modules.php, or (3) admin.php in PostNuke 0.760-RC2 allow remote attackers to execute arbitrary SQL code via the catid… Affected: 0.760_rc2 |
| CVE-2005-1050 | – | May 2 | The modload op in the Reviews module for PostNuke 0.760-RC3 allows remote attackers to obtain sensitive information via an invalid id parameter, which reveals the path in a PHP… Affected: 0.760_rc3 |
| CVE-2005-1049 | – | May 2 | Multiple cross-site scripting vulnerabilities in PostNuke 0.760-RC3 allow remote attackers to inject arbitrary web script or HTML via the (1) module parameter to admin.php or (2)… Affected: 0.760_rc3 |
| CVE-2005-1048 | – | May 2 | SQL injection vulnerability in modules.php in PostNuke 0.760 RC3 allows remote attackers to execute arbitrary SQL statements via the sid parameter Affected: 0.760_rc3 |
| CVE-2005-0617 | – | May 2 | SQL injection vulnerability in dl-search.php in PostNuke 0.750 and 0.760-RC2 allows remote attackers to execute arbitrary SQL commands via the show parameter Affected: 0.750; 0.760_rc2 |
| CVE-2004-2751 | – | Dec 31 | SQL injection vulnerability in the members_list module in PostNuke 0.726, and possibly earlier, allows remote attackers to execute arbitrary SQL commands via the sortby parameter Affected: 0.722; 0.723; 0.726 |
| CVE-2004-2752 | – | Dec 31 | Cross-site scripting (XSS) vulnerability in the Downloads module in PostNuke up to 0.726, and possibly later versions, allows remote attackers to inject arbitrary HTML and web… Affected: 0.726 |
| CVE-2004-1949 | – | Dec 31 | SQL injection vulnerability in PostNuke 7.2.6 and earlier allows remote attackers to execute arbitrary SQL via (1) the sif parameter to index.php in the Comments module or (2)… Affected: 0.726 |
| CVE-2004-1956 | – | Apr 21 | PostNuke 0.7.2.6 allows remote attackers to gain information via a direct HTTP request to files in the (1) includes/blocks directory, (2) pnadodb directory, (3) NS-NewUser module,… Affected: 0.726 |
| CVE-2003-1537 | – | Dec 31 | Directory traversal vulnerability in PostNuke 0.723 and earlier allows remote attackers to include arbitrary files named theme.php via the theme parameter to index.php Affected: through 0.723 |
| CVE-2002-1996 | – | Dec 31 | Cross-site scripting (XSS) vulnerability in PostNuke 0.71 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) name parameter in modules.php and… Affected: 0.7; 0.62; 0.63; 0.64; 0.70; 0.71; +1 more |
| CVE-2002-2015 | – | Dec 31 | PHP file inclusion vulnerability in user.php in PostNuke 0.703 allows remote attackers to include arbitrary files and possibly execute code via the caselist parameter Affected: 0.703 |
| CVE-2002-0535 | – | Jul 3 | Cross-site scripting vulnerabilities in PostBoard 2.0.1 and earlier allows remote attackers to execute script as other users via (1) an [IMG] tag when BBCode is enabled, or (2) in… Affected: 0.64; 0.70; 0.71; 0.703 |
| CVE-2001-1521 | – | Dec 31 | Cross-site scripting (XSS) vulnerability in user.php in PostNuke 0.64 allows remote attackers to inject arbitrary web script or HTML via the uname parameter Affected: 0.62; 0.63; 0.64 |
| CVE-2001-0911 | – | Nov 21 | PHP-Nuke 5.1 stores user and administrator passwords in a base-64 encoded cookie, which could allow remote attackers to gain privileges by stealing or sniffing the cookie and… Affected: 0.64 |
| CVE-2001-1460 | – | Oct 13 | SQL injection vulnerability in article.php in PostNuke 0.62 through 0.64 allows remote attackers to bypass authentication via the user parameter Affected: 0.62; 0.63; 0.64 |
Showing 38