Vulnerabilities > Postnuke Software Foundation > Postnuke > Low
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2006-02-20 | CVE-2006-0800 | Cross-Site Scripting vulnerability in Postnuke Software Foundation Postnuke Interpretation conflict in PostNuke 0.761 and earlier allows remote attackers to conduct cross-site scripting (XSS) attacks via HTML tags with a trailing "<" character, which is interpreted as a ">" character by some web browsers but bypasses the blacklist protection in (1) the pnVarCleanFromInput function in pnAPI.php, (2) the pnSecureInput function in pnAntiCracker.php, and (3) the htmltext parameter in an edituser operation to user.php. | 2.6 |
| 2006-02-20 | CVE-2006-0802 | Input Validation vulnerability in PostNuke Cross-site scripting (XSS) vulnerability in the NS-Languages module for PostNuke 0.761 and earlier, when magic_quotes_gpc is enabled, allows remote attackers to inject arbitrary web script or HTML via the language parameter in a missing or translation operation. | 2.6 |
| 2005-08-24 | CVE-2005-2689 | Cross-Site Scripting vulnerability in Postnuke Software Foundation Postnuke 0.76Rc4B Multiple cross-site scripting (XSS) vulnerabilities in PostNuke 0.760-RC4b allows remote attackers to inject arbitrary web script or HTML via (1) the moderate parameter to the Comments module or (2) htmltext parameter to html/user.php. | 2.6 |
| 2005-05-31 | CVE-2005-1778 | Cross-Site Scripting vulnerability in Postnuke Software Foundation Postnuke 0.750 Cross-site scripting (XSS) vulnerability in readpmsg.php in PostNuke 0.750 allows remote attackers to inject arbitrary web script or HTML via the start parameter. | 2.6 |
| 2005-05-24 | CVE-2005-1695 | Unspecified vulnerability in Postnuke Software Foundation Postnuke 0.750/0.760Rc2/0.760Rc3 Multiple cross-site scripting (XSS) vulnerabilities in the RSS module in PostNuke 0.750 and 0.760RC2 and RC3 allow remote attackers to inject arbitrary web script or HTML via the (1) rss_url parameter to magpie_slashbox.php, or the url parameter to (2) magpie_simple.php or (3) magpie_debug.php. | 2.6 |
| 2005-05-24 | CVE-2005-1696 | Unspecified vulnerability in Postnuke Software Foundation Postnuke 0.750/0.760Rc3 Multiple cross-site scripting (XSS) vulnerabilities in PostNuke 0.750 and 0.760RC3 allow remote attackers to inject arbitrary web script or HTML via the (1) skin or (2) paletteid parameter to demo.php in the Xanthia module, or (3) the serverName parameter to config.php in the Multisites (aka NS-Multisites) module. | 2.6 |
| 2005-05-02 | CVE-2005-1049 | Remote Cross-Site Scripting vulnerability in Postnuke Software Foundation Postnuke 0.760Rc3 Multiple cross-site scripting vulnerabilities in PostNuke 0.760-RC3 allow remote attackers to inject arbitrary web script or HTML via the (1) module parameter to admin.php or (2) op parameter to user.php. | 2.6 |
| 2004-04-21 | CVE-2004-1957 | Cross-Site Scripting And Path Disclosure vulnerability in PostNuke Phoenix Multiple cross-site scripting (XSS) vulnerabilities in PostNuke 0.726 allows remote attackers to inject arbitrary web script or HTML via the (1) lid and query parameters to the Downloads module, (2) query parameter to the Web_links module, or (3) hlpfile parameter to openwindow.php. | 2.6 |
| 2002-12-31 | CVE-2002-1996 | Cross-Site Scripting vulnerability in PostNuke Cross-site scripting (XSS) vulnerability in PostNuke 0.71 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) name parameter in modules.php and (2) catid parameter in index.php. | 2.6 |
| 2001-12-31 | CVE-2001-1521 | Cross-Site Scripting vulnerability in Postnuke Software Foundation Postnuke 0.62/0.63/0.64 Cross-site scripting (XSS) vulnerability in user.php in PostNuke 0.64 allows remote attackers to inject arbitrary web script or HTML via the uname parameter. | 2.6 |