CVE-2001-1524: francisco_burzi php-nuke
Vulnerability summary
CVE-2001-1524 is a medium (CVSS 4.3) vulnerability in francisco_burzi php-nuke. EPSS estimates a 2.01% chance of exploitation in the next 30 days, higher than 80.5% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 14-07-2005PublishedVulnerability first disclosed.
- 08-08-2024Last modifiedVulnerability information updated.
Description
Cross-site scripting (XSS) vulnerability in PHP-Nuke 5.3.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) uname parameter in user.php, (2) ttitle, letter and file parameters in modules.php, (3) subject, story and storyext parameters in submit.php, (4) upload parameter in admin.php and (5) fname parameter in friend.php.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
2.01%
Chance of exploitation in the next 30 days
Percentile
81%
Versus all other CVEs
30-day change
0.00 pp
From 2.01% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundPHP-Nuke 1.0/2.5/3.0/4.x/5.x/6.x/7.x - 'modules.php' Multiple Cross-Site Scripting Vulnerabilities
Maturity: poc
PHP-Nuke 1.0/2.5/3.0/4.x/5.x/6.x/7.x - 'user.php?uname' Cross-Site Scripting
Maturity: poc
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Francisco_burzi1 product
- php-nuke3.0 | 4.0 | 4.3 | 4.4 | 4.4.1a | 5.0 | 5.0.1 | 5.1 | 5.2 | 5.2a | 5.3.1
1 vendor · 1 product