CVE-2007-1061: francisco_burzi php-nuke

EPSS trend

Probability

61.76%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

+0.99 pp

From 60.77% on 19-09-2026

19-09-202619-10-2026

EPSS score

61.76%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

3 found

exploit-databasephpVerified
PHP-Nuke 8.0 Final - 'INSERT' Blind SQL Injection (MySQL)
Maturity: poc
exploit-databasephpVerified
PHP-Nuke 8.0 Final - 'INSERT' SQL Injection
Maturity: poc
exploit-databasephpVerified
PHP-Nuke 8.0 Final - HTTP Referers SQL Injection
Maturity: poc

References

8 links

www.securityfocus.com/bid/22638VDB EntryX Refsource BID
www.exploit-db.com/exploits/3346ExploitX Refsource EXPLOIT DB
exchange.xforce.ibmcloud.com/vulnerabilities/32607VDB EntryX Refsource XF
osvdb.org/33316VDB EntryX Refsource OSVDB
www.securityfocus.com/archive/1/461148/100/0/threadedMailing ListX Refsource BUGTRAQ
www.vupen.com/english/advisories/2007/0673VDB EntryX Refsource VUPEN
secunia.com/advisories/24224Third Party AdvisoryX Refsource SECUNIAVendor Advisory
lists.grok.org.uk/pipermail/full-disclosure/2007-February/052570.htmlMailing ListX Refsource FULLDISC

Related vulnerabilities

CVE-2003-1210francisco_burziphp-nuke5.37%21y ago19-05-2005 04:00Multiple SQL injection vulnerabilities in the Downloads module for PHP-Nuke 5.x through 6.5 allow remote attackers to execute arbitrary SQL commands via the (1) lid parameter to the getit function or the (2) min parameter to the search function.CVE-2003-0318francisco_burziphp-nuke1.04%23y ago22-05-2003 04:00Cross-site scripting (XSS) vulnerability in the Statistics module for PHP-Nuke 6.0 and earlier allows remote attackers to insert arbitrary web script via the year parameter.CVE-2007-0372francisco_burziphp-nuke4.01%19y ago19-01-2007 23:00Multiple SQL injection vulnerabilities in Francisco Burzi PHP-Nuke 7.9 allow remote attackers to execute arbitrary SQL commands via (1) the active parameter in admin/modules/modules.php; the (2) ad_class, (3) imageurl, (4) clickurl, (5) ad_code, or (6) position parameter in modules/Advertising/admin/index.php; or unspecified vectors in the (7) advertising, (8) weblinks, or (9) reviews section.CVE-2007-0309francisco_burziphp-nuke4.70%19y ago18-01-2007 00:00SQL injection vulnerability in blocks/block-Old_Articles.php in Francisco Burzi PHP-Nuke 7.9 and earlier, when register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the cat parameter.CVE-2007-5032francisco_burziphp-nuke0.57%19y ago21-09-2007 18:00Cross-site request forgery (CSRF) vulnerability in admin.php in Francisco Burzi PHP-Nuke allows remote attackers to add administrative accounts via an AddAuthor action with modified add_name and add_radminsuper parameters.CVE-2001-1032francisco_burziphp-nuke3.12%24y ago25-06-2002 04:00admin.php in PHP-Nuke 5.2 and earlier, except 5.0RC1, does not check login credentials for upload operations, which allows remote attackers to copy and upload arbitrary files and read the PHP-Nuke configuration file by directly calling admin.php with an upload parameter and specifying the file to copy.

All vulnerabilities inphp-nuke

CVE-2007-1061: francisco_burzi php-nuke

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References