Show filters
124 Total Results
Displaying 1-10 of 124
Sort by:
Attacker Value
Unknown
CVE-2021-30177
Disclosure Date: April 07, 2021 (last updated February 22, 2025)
There is a SQL Injection vulnerability in PHP-Nuke 8.3.3 in the User Registration section, leading to remote code execution. This occurs because the U.S. state is not validated to be two letters, and the OrderBy field is not validated to be one of LASTNAME, CITY, or STATE.
0
Attacker Value
Unknown
CVE-2014-3934
Disclosure Date: June 02, 2014 (last updated October 05, 2023)
SQL injection vulnerability in the Submit_News module for PHP-Nuke 8.3 allows remote attackers to execute arbitrary SQL commands via the topics[] parameter to modules.php.
0
Attacker Value
Unknown
CVE-2010-5083
Disclosure Date: February 14, 2012 (last updated October 04, 2023)
SQL injection vulnerability in the Web_Links module for PHP-Nuke 8.0 allows remote attackers to execute arbitrary SQL commands via the url parameter in an Add action to modules.php.
0
Attacker Value
Unknown
CVE-2011-3784
Disclosure Date: September 24, 2011 (last updated October 04, 2023)
Francisco Burzi PHP-Nuke 8.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by themes/Odyssey/theme.php and certain other files.
0
Attacker Value
Unknown
CVE-2011-1480
Disclosure Date: June 21, 2011 (last updated October 04, 2023)
SQL injection vulnerability in admin.php in the administration backend in Francisco Burzi PHP-Nuke 8.0 and earlier allows remote attackers to execute arbitrary SQL commands via the chng_uid parameter.
0
Attacker Value
Unknown
CVE-2011-1482
Disclosure Date: June 21, 2011 (last updated October 04, 2023)
Multiple cross-site request forgery (CSRF) vulnerabilities in mainfile.php in Francisco Burzi PHP-Nuke 8.0 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) add user accounts or (2) grant the administrative privilege to a user account, related to a Referer check that uses a substring comparison.
0
Attacker Value
Unknown
CVE-2011-1481
Disclosure Date: June 21, 2011 (last updated October 04, 2023)
Multiple cross-site scripting (XSS) vulnerabilities in Francisco Burzi PHP-Nuke 8.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) sender_name or (2) sender_email parameter in a Feedback action to modules.php.
0
Attacker Value
Unknown
CVE-2009-1842
Disclosure Date: June 01, 2009 (last updated October 04, 2023)
SQL injection vulnerability in main/tracking/userLog.php in Francisco Burzi PHP-Nuke 8.0 allows remote attackers to execute arbitrary SQL commands via the HTTP Referer header.
0
Attacker Value
Unknown
CVE-2008-6728
Disclosure Date: April 20, 2009 (last updated October 04, 2023)
SQL injection vulnerability in the Sections module in PHP-Nuke, probably before 8.0, allows remote attackers to execute arbitrary SQL commands via the artid parameter in a printpage action to modules.php.
0
Attacker Value
Unknown
CVE-2008-3573
Disclosure Date: August 10, 2008 (last updated October 04, 2023)
The CAPTCHA implementation in (1) Pligg 9.9.5 and possibly (2) Francisco Burzi PHP-Nuke 8.1 provides a critical random number (the ts_random value) within the URL in the SRC attribute of an IMG element, which allows remote attackers to pass the CAPTCHA test via a calculation that combines this value with the current date and the HTTP User-Agent string.
0
