CVE-2004-2293: francisco_burzi php-nuke
Vulnerability summary
CVE-2004-2293 is a medium (CVSS 4.3) vulnerability in francisco_burzi php-nuke. EPSS estimates a 1.97% chance of exploitation in the next 30 days, higher than 80.2% of scored vulnerabilities. 6 public exploits are recorded.
Timeline
- 04-08-2005PublishedVulnerability first disclosed.
- 08-08-2024Last modifiedVulnerability information updated.
Description
Multiple cross-site scripting (XSS) vulnerabilities in PHP-Nuke 6.0 to 7.3 allow remote attackers to inject arbitrary web script or HTML via the (1) eid parameter or (2) query parameter to the Encyclopedia module, (3) preview_review function in the Reviews module as demonstrated by the url, cover, rlanguage, and hits parameters, or (4) savecomment function in the Reviews module, as demonstrated using the uname parameter. NOTE: the Faq/categories and Encyclopedia/ltr issues are already covered by CVE-2005-1023.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
1.97%
Chance of exploitation in the next 30 days
Percentile
80%
Versus all other CVEs
30-day change
0.00 pp
From 1.97% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
6 foundExploit Reference (osvdb.org)
Maturity: unknown
Exploit Reference (osvdb.org)
Maturity: unknown
Exploit Reference (securityfocus.com)
Maturity: unknown
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Francisco_burzi1 product
- php-nuke6.0 | 6.5 | 6.5_beta1 | 6.5_final | 6.5_rc1 | 6.5_rc2 | 6.5_rc3 | 6.6 | 6.7 | 6.9 | 7.0 | 7.0_final | 7.1 | 7.2 | 7.3
1 vendor · 1 product