Postnuke Software Foundation vulnerabilities, page 3
47 vulnerabilities
Known vulnerabilities in Postnuke Software Foundation products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 8 products.
CVE-2006-0802postnuke_software_foundationpostnuke
EPSS score1.37%
Cross-site scripting (XSS) vulnerability in the NS-Languages module for PostNuke 0.761 and earlier, when magic_quotes_gpc is enabled, allows remote attackers to inject arbitrary web script or HTML via the language parameter in a missing or translation operation.CVE-2006-0801postnuke_software_foundationpostnukeEPSS score1.22%
SQL injection vulnerability in the NS-Languages module for PostNuke 0.761 and earlier, when magic_quotes_gpc is off, allows remote attackers to execute arbitrary SQL commands via the language parameter to admin.php.CVE-2006-4968postnuke_software_foundationpnphpbbEPSS score9.73%
PHP remote file inclusion vulnerability in includes/functions_admin.php in PNphpBB 1.2g allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.CVE-2006-5733postnuke_software_foundationpostnukeEPSS score3.01%
Directory traversal vulnerability in error.php in PostNuke 0.763 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the PNSVlang (PNSV lang) cookie, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by error.php.CVE-2006-5121postnuke_software_foundationpostnukeEPSS score1.35%
SQL injection vulnerability in modules/Downloads/admin.php in the Admin section of PostNuke 0.762 allows remote attackers to execute arbitrary SQL commands via the hits parameter.CVE-2006-6233postnuke_software_foundationpostnukeEPSS score1.15%
SQL injection vulnerability in the Downloads module for unknown versions of PostNuke allows remote attackers to execute arbitrary SQL commands via the lid parameter in a viewdownloaddetails operation. NOTE: this issue might have been in the viewdownloaddetails function in dl-downloaddetails.php, but PostNuke 0.764 does not appear to have this issue.CVE-2006-6267postnuke_software_foundationpostnukeEPSS score1.40%
PostNuke 0.7.5.0, and certain minor versions, allows remote attackers to obtain sensitive information via a non-numeric value of the stop parameter, which reveals the path in an error message.