{"id":"CVE-2005-1000","url":"https://www.cyber-defence.io/tools/cve/CVE-2005-1000","generatedAt":"2026-10-27T20:52:01.065Z","title":"Multiple cross-site scripting (XSS) vulnerabilities in PHP-Nuke 7.6 allow remote attackers to inject arbitrary web script or HTML via (1) the bid parameter to the EmailStats op in banners.pgp, (2) the ratenum parameter in the TopRated and MostPopular…","description":"Multiple cross-site scripting (XSS) vulnerabilities in PHP-Nuke 7.6 allow remote attackers to inject arbitrary web script or HTML via (1) the bid parameter to the EmailStats op in banners.pgp, (2) the ratenum parameter in the TopRated and MostPopular actions in the Web_Links module, (3) the ttitle parameter in the viewlinkdetails, viewlinkeditorial, viewlinkcomments, and ratelink actions in the Web_Links module, or (4) the username parameter in the Your_Account module.","published":"2005-05-02T04:00:00.000Z","lastModified":"2026-06-16T22:12:15.000Z","status":"Modified","sourceIdentifier":"cve@mitre.org","cvss":{"version":"2.0","score":4.3,"severity":"MEDIUM","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N"},"cwe":[],"affected":["francisco burzi/php-nuke"],"epss":{"score":0.01765,"percentile":0.77904,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":4,"verified":true,"firstPublished":"2005-04-05","source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[{"edbId":25343,"kind":"exploit","title":"PHP-Nuke 7.6 - 'banners.php' Cross-Site Scripting","url":"https://www.exploit-db.com/exploits/25343","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/25343.txt","file":"exploits/php/webapps/25343.txt","published":"2005-04-06","added":"2005-04-06","updated":"2013-05-10","author":"Maksymilian Arciemowicz","type":"webapps","platform":"php","port":null,"verified":true,"codes":["CVE-2005-1000","OSVDB-15399"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":"https://www.securityfocus.com/bid/13026/info"},{"edbId":25342,"kind":"exploit","title":"PHP-Nuke 7.6 Web_Links Module - Multiple Cross-Site Scripting Vulnerabilities","url":"https://www.exploit-db.com/exploits/25342","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/25342.txt","file":"exploits/php/webapps/25342.txt","published":"2005-04-06","added":"2005-04-06","updated":"2013-05-10","author":"Maksymilian Arciemowicz","type":"webapps","platform":"php","port":null,"verified":true,"codes":["CVE-2005-1000","OSVDB-15398"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":"https://www.securityfocus.com/bid/13025/info"},{"edbId":25340,"kind":"exploit","title":"PHP-Nuke 6.x/7.x Your_Account Module - Avatarcategory Cross-Site Scripting","url":"https://www.exploit-db.com/exploits/25340","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/25340.txt","file":"exploits/php/webapps/25340.txt","published":"2005-04-05","added":"2005-04-05","updated":"2013-05-10","author":"sp3x@securityreason.com","type":"webapps","platform":"php","port":null,"verified":true,"codes":["CVE-2005-1000","OSVDB-15400"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":"https://www.securityfocus.com/bid/13010/info"},{"edbId":25339,"kind":"exploit","title":"PHP-Nuke 6.x/7.x Your_Account Module - 'Username' Cross-Site Scripting","url":"https://www.exploit-db.com/exploits/25339","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/25339.txt","file":"exploits/php/webapps/25339.txt","published":"2005-04-05","added":"2005-04-05","updated":"2013-05-10","author":"sp3x@securityreason.com","type":"webapps","platform":"php","port":null,"verified":true,"codes":["CVE-2005-1000","OSVDB-15400"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":"https://www.securityfocus.com/bid/13007/info"}]},"verdict":{"level":"high","text":"4 public exploits are published in Exploit-DB (verified), so the technical barrier is gone even though the severity is medium and EPSS is 1.8%. Treat it as high on anything reachable from the internet."},"changes":[],"references":[{"url":"http://archives.neohapsis.com/archives/bugtraq/2005-04/0037.html","tags":["Exploit","Vendor Advisory"],"source":"cve@mitre.org"},{"url":"http://marc.info/?l=bugtraq&m=111263454308478&w=2","source":"cve@mitre.org"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/19952","source":"cve@mitre.org"},{"url":"http://archives.neohapsis.com/archives/bugtraq/2005-04/0037.html","tags":["Exploit","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://marc.info/?l=bugtraq&m=111263454308478&w=2","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/19952","source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2005-1000","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}