Francisco Burzi Php Nuke vulnerabilities, page 5
94 vulnerabilities
Known vulnerabilities in Francisco Burzi Php Nuke, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
MediumCVE-2002-2032francisco_burzi · php-nukefrancisco_burzi php-nukesql_layer.php in PHP-Nuke 5.4 and earlier does not restrict access to debugging features, which allows remote attackers to gain SQL query information by setting the sql_debug parameter to (1) index.php and (2) modules.php.EPSS5.85%HighCVE-2002-1242francisco_burzi · php-nukefrancisco_burzi php-nukeSQL injection vulnerability in PHP-Nuke before 6.0 allows remote authenticated users to modify the database and gain privileges via the "bio" argument to modules.php.EPSS4.11%MediumCVE-2002-1803francisco_burzi · php-nukefrancisco_burzi php-nukeCross-site scripting (XSS) vulnerability in PHP-Nuke 6.0 allows remote attackers to inject arbitrary web script or HTML via Javascript in an IMG tag.EPSS1.72%MediumCVE-2002-0483francisco_burzi · php-nukefrancisco_burzi php-nukeindex.php for PHP-Nuke 5.4 and earlier allows remote attackers to determine the physical pathname of the web server when the file parameter is set to index.php, which triggers an error message that leaks the pathname.EPSS8.24%HighCVE-2002-0206francisco_burzi · php-nukefrancisco_burzi php-nukeindex.php in Francisco Burzi PHP-Nuke 5.3.1 and earlier, and possibly other versions before 5.5, allows remote attackers to execute arbitrary PHP code by specifying a URL to the malicious code in the file parameter.EPSS6.50%MediumCVE-2006-1846francisco_burzi · php-nukefrancisco_burzi php-nukeCross-site scripting (XSS) vulnerability in the Your_Account module in PHP-Nuke 7.8 might allows remote attackers to inject arbitrary HTML and web script via the ublock parameter, which is saved in the user's personal menu. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. In addition, it is unclear whether this issue is a vulnerability, since it is related to the user's personal menu, which presumably is not modifiable by others.EPSS1.18%HighCVE-2006-1847francisco_burzi · php-nukefrancisco_burzi php-nukeSQL injection vulnerability in the Your_Account module in PHP-Nuke 7.8 might allows remote attackers to execute arbitrary SQL commands via the user_id parameter in the Your_Home functionality. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.EPSS1.47%HighCVE-2006-0805francisco_burzi · php-nukefrancisco_burzi php-nukeThe CAPTCHA functionality in php-Nuke 6.0 through 7.9 uses fixed challenge/response pairs that only vary once per day based on the User Agent (HTTP_USER_AGENT), which allows remote attackers to bypass CAPTCHA controls by fixing the User Agent, performing a valid challenge/response, then replaying that pair in the random_num and gfx_check parameters.EPSS3.00%HighCVE-2006-0908francisco_burzi · php-nukefrancisco_burzi php-nukePHP-Nuke 7.8 Patched 3.2 allows remote attackers to bypass SQL injection protection mechanisms via /%2a (/*) sequences with the "ad_click" word in the query string, as demonstrated via the kala parameter.EPSS1.81%HighCVE-2006-0907francisco_burzi · php-nukefrancisco_burzi php-nukeSQL injection vulnerability in PHP-Nuke before 7.8 Patched 3.2 allows remote attackers to execute arbitrary SQL commands via encoded /%2a (/*) sequences in the query string, which bypasses regular expressions that are intended to protect against SQL injection, as demonstrated via the kala parameter.EPSS1.67%MediumCVE-2006-0676francisco_burzi · php-nukefrancisco_burzi php-nukeCross-site scripting (XSS) vulnerability in header.php in PHP-Nuke 6.0 to 7.8 allows remote attackers to inject arbitrary web script or HTML via the pagetitle parameter.EPSS1.98%HighCVE-2006-5720francisco_burzi · php-nukefrancisco_burzi php-nukeSQL injection vulnerability in modules/journal/search.php in the Journal module in Francisco Burzi PHP-Nuke 7.9 and earlier allows remote attackers to execute arbitrary SQL commands via the forwhat parameter.EPSS2.04%HighCVE-2006-6234francisco_burzi · php-nukefrancisco_burzi php-nukeMultiple SQL injection vulnerabilities in the Content module in PHP-Nuke 6.0, and possibly other versions, allow remote attackers to execute arbitrary SQL commands via (1) the cid parameter in a list_pages_categories action or (2) the pid parameter in a showpage action.EPSS1.97%HighCVE-2006-6200francisco_burzi · php-nukefrancisco_burzi php-nukeMultiple SQL injection vulnerabilities in the (1) rate_article and (2) rate_complete functions in modules/News/index.php in the News module in Francisco Burzi PHP-Nuke 7.9 and earlier, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the sid parameter.EPSS3.43%