Vulnerabilities > Francisco Burzi > PHP Nuke > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2004-03-15 | CVE-2004-1817 | Cross-Site Scripting vulnerability in Francisco Burzi PHP-Nuke 7.1 Cross-site scripting (XSS) vulnerability in modules.php in Php-Nuke 7.1.0 allows remote attackers to inject arbitrary web script or HTML via the (1) Your Name field, (2) e-mail field, (3) nicname field, (4) fname parameter, (5) ratenum parameter, or (6) search field. network francisco-burzi | 4.3 |
| 2003-12-31 | CVE-2003-1547 | Cross-Site Scripting vulnerability in Francisco Burzi PHP-Nuke Cross-site scripting (XSS) vulnerability in block-Forums.php in the Splatt Forum module for PHP-Nuke 6.x allows remote attackers to inject arbitrary web script or HTML via the subject parameter. | 4.3 |
| 2003-12-31 | CVE-2003-1526 | Information Exposure vulnerability in Francisco Burzi PHP-Nuke 7.0 PHP-Nuke 7.0 allows remote attackers to obtain the installation path via certain characters such as (1) ", (2) ', or (3) > in the search field, which reveals the path in an error message. | 5.0 |
| 2003-12-31 | CVE-2003-1468 | Information Exposure vulnerability in Francisco Burzi PHP-Nuke The Web_Links module in PHP-Nuke 6.0 through 6.5 final allows remote attackers to obtain the full web server path via an invalid cid parameter that is non-numeric or null, which leaks the pathname in an error message. | 4.3 |
| 2003-12-31 | CVE-2003-1400 | Cross-Site Scripting vulnerability in Francisco Burzi PHP-Nuke Cross-site scripting (XSS) vulnerability in the Your_Account module for PHP-Nuke 5.0 through 6.0 allows remote attackers to inject arbitrary web script or HTML via the user_avatar parameter. | 4.3 |
| 2003-06-09 | CVE-2003-0318 | Cross-Site Scripting vulnerability in PHP-Nuke Cross-site scripting (XSS) vulnerability in the Statistics module for PHP-Nuke 6.0 and earlier allows remote attackers to insert arbitrary web script via the year parameter. network francisco-burzi | 4.3 |
| 2002-12-31 | CVE-2002-1803 | HTML Injection vulnerability in Francisco Burzi PHP-Nuke 6.0 Cross-site scripting (XSS) vulnerability in PHP-Nuke 6.0 allows remote attackers to inject arbitrary web script or HTML via Javascript in an IMG tag. network francisco-burzi | 4.3 |
| 2002-08-12 | CVE-2002-0483 | Unspecified vulnerability in Francisco Burzi PHP-Nuke index.php for PHP-Nuke 5.4 and earlier allows remote attackers to determine the physical pathname of the web server when the file parameter is set to index.php, which triggers an error message that leaks the pathname. | 5.0 |
| 2001-12-31 | CVE-2001-1524 | Cross-Site Scripting vulnerability in PHPNuke Cross-site scripting (XSS) vulnerability in PHP-Nuke 5.3.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) uname parameter in user.php, (2) ttitle, letter and file parameters in modules.php, (3) subject, story and storyext parameters in submit.php, (4) upload parameter in admin.php and (5) fname parameter in friend.php. network francisco-burzi | 4.3 |
| 2001-12-31 | CVE-2001-1522 | Cross-Site Scripting vulnerability in Francisco Burzi PHP-Nuke 8.0Final Cross-site scripting (XSS) vulnerability in im.php in IMessenger for PHP-Nuke allows remote attackers to inject arbitrary web script or HTML via a message. network francisco-burzi | 4.3 |