Vulnerabilities > Francisco Burzi > PHP Nuke > High
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2004-07-27 | CVE-2004-0732 | SQL-Injection vulnerability in Francisco Burzi PHP-Nuke 8.0Final SQL injection vulnerability in index.php in the Search module for Php-Nuke allows remote attackers to execute arbitrary SQL statements via the instory parameter. | 7.5 |
| 2004-06-01 | CVE-2004-2044 | PHP-Nuke 7.3, and other products that use the PHP-Nuke codebase such as the Nuke Cops betaNC PHP-Nuke Bundle, OSCNukeLite 3.1, and OSC2Nuke 7x do not properly use the eregi() PHP function with $_SERVER['PHP_SELF'] to identify the calling script, which allows remote attackers to directly access scripts, obtain path information via a PHP error message, and possibly gain access, as demonstrated using an HTTP request that contains the "admin.php" string. | 7.5 |
| 2004-05-05 | CVE-2004-2000 | SQL Injection vulnerability in PHP-Nuke Modules.php SQL injection vulnerability in the Downloads module in Php-Nuke 6.x through 7.2 allows remote attackers to execute arbitrary SQL via the (1) orderby or (2) sid parameters to modules.php. | 7.5 |
| 2004-04-30 | CVE-2004-1989 | Input Validation vulnerability in Coppermine Photo Gallery PHP remote file inclusion vulnerability in theme.php in Coppermine Photo Gallery 1.2.2b allows remote attackers to execute arbitrary PHP code by modifying the THEME_DIR parameter to reference a URL on a remote web server that contains user_list_info_box.inc. | 7.5 |
| 2004-04-30 | CVE-2004-1988 | Input Validation vulnerability in Coppermine Photo Gallery PHP remote file inclusion vulnerability in init.inc.php in Coppermine Photo Gallery 1.2.0 RC4 allows remote attackers to execute arbitrary PHP code by modifying the CPG_M_DIR to reference a URL on a remote web server that contains functions.inc.php. | 7.5 |
| 2004-04-30 | CVE-2004-1987 | Input Validation vulnerability in Coppermine Photo Gallery picmgmtbatch.inc.php in Coppermine Photo Gallery 1.2.2b and 1.2.0 RC4 allows remote attackers with administrative privileges to execute arbitrary commands via shell metacharacters in the (1) $CONFIG['impath'] or (2) $CONFIG['jpeg_qual'] parameters. | 7.5 |
| 2004-04-26 | CVE-2004-1972 | Video Gallery Module SQL Injection vulnerability in Francisco Burzi PHP-Nuke 7.2 SQL injection vulnerability in modules.php in PHP-Nuke Video Gallery Module 0.1 Beta 5 allows remote attackers to execute arbitrary SQL code via the (1) clipid or (2) catid parameters in a viewclip, viewcat, or voteclip action. | 7.5 |
| 2004-04-13 | CVE-2004-1929 | SQL Injection vulnerability in PHP-Nuke SQL injection vulnerability in the bblogin function in functions.php in PHP-Nuke 6.x through 7.2 allows remote attackers to bypass authentication and gain access by injecting base64-encoded SQL code into the user parameter. | 7.5 |
| 2004-04-12 | CVE-2004-1932 | SQL-Injection vulnerability in PHP-Nuke SQL injection vulnerability in (1) auth.php and (2) admin.php in PHP-Nuke 6.x through 7.2 allows remote attackers to execute arbitrary SQL code and create an administrator account via base64-encoded SQL in the admin parameter. | 7.5 |
| 2003-12-31 | CVE-2003-1435 | SQL Injection vulnerability in Francisco Burzi PHP-Nuke 5.6/6.0 SQL injection vulnerability in PHP-Nuke 5.6 and 6.0 allows remote attackers to execute arbitrary SQL commands via the days parameter to the search module. | 7.5 |