Phpnuke vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2021-30177 There is a SQL Injection vulnerability in PHP-Nuke 8.3.3 in the User Registration section, leading to remote code execution.Critical 9.8 · Apr 7, 2021
• CVE-2014-3934 SQL injection vulnerability in the Submit_News module for PHP-Nuke 8.3 allows remote attackers to execute arbitrary SQL commands via the topics[] parameter to mHigh 7.5 · Jun 2, 2014
• CVE-2010-5083 SQL injection vulnerability in the Web_Links module for PHP-Nuke 8.0 allows remote attackers to execute arbitrary SQL commands via the url parameter in an Add aHigh 7.5 · Feb 14, 2012
• CVE-2011-1480 SQL injection vulnerability in admin.php in the administration backend in Francisco Burzi PHP-Nuke 8.0 and earlier allows remote attackers to execute arbitrary High 7.5 · Jun 20, 2011
• CVE-2009-1842 SQL injection vulnerability in main/tracking/userLog.php in Francisco Burzi PHP-Nuke 8.0 allows remote attackers to execute arbitrary SQL commands via the HTTP High 7.5 · Jun 1, 2009
• CVE-2008-6779 SQL injection vulnerability in the Sarkilar module for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the id parameter in a showcontent High 7.5 · May 1, 2009
• CVE-2008-6728 SQL injection vulnerability in the Sections module in PHP-Nuke, probably before 8.0, allows remote attackers to execute arbitrary SQL commands via the artid parHigh 7.5 · Apr 20, 2009
• CVE-2008-3151 SQL injection vulnerability in the 4ndvddb 0.91 module for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the id parameter in a show_dvdHigh 7.5 · Jul 11, 2008
• CVE-2008-1219 SQL injection vulnerability in the Kutub-i Sitte (KutubiSitte) 1.1 module for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the kid parHigh 7.5 · Mar 10, 2008
• CVE-2008-1220 SQL injection vulnerability in the 4nChat 0.91 module for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the roomid parameter in an indeHigh 7.5 · Mar 10, 2008
• CVE-2008-1053 Multiple SQL injection vulnerabilities in the Kose_Yazilari module for PHP-Nuke allow remote attackers to execute arbitrary SQL commands via the artid parameterHigh 7.5 · Feb 27, 2008
• CVE-2008-0879 SQL injection vulnerability in modules.php in the Web_Links module for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the cid parameter High 7.5 · Feb 21, 2008
• CVE-2008-0880 SQL injection vulnerability in modules.php in the EasyContent module for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the page_id paraHigh 7.5 · Feb 21, 2008
• CVE-2008-0881 SQL injection vulnerability in modules.php in the Okul 1.0 module for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the okulid parameteHigh 7.5 · Feb 21, 2008
• CVE-2008-0827 SQL injection vulnerability in the Books module of PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the cid parameter.High 7.5 · Feb 19, 2008
• CVE-2007-1450 SQL injection vulnerability in mainfile.php in PHP-Nuke 8.0 and earlier allows remote attackers to execute arbitrary SQL commands in the Top or News module via High 7.5 · Mar 14, 2007
• CVE-2006-5494 Multiple PHP remote file inclusion vulnerabilities in modules/My_eGallery/public/displayCategory.php in the pandaBB module for PHP-Nuke allow remote attackers tHigh 7.5 · Oct 25, 2006
• CVE-2004-1842 Cross-site request forgery (CSRF) vulnerability in Php-Nuke 6.x through 7.1.0 allows remote attackers to gain administrative privileges via an img tag with a URHigh 8.8 · Dec 31, 2004
• CVE-2001-0899 Network Tools 0.2 for PHP-Nuke allows remote attackers to execute commands on the server via shell metacharacters in the $hostinput variable.High 7.5 · Nov 16, 2001