CVE-2005-1023
Multiple cross-site scripting (XSS) vulnerabilities in PHP-Nuke 6.x to 7.6 allow remote attackers to inject arbitrary web script or HTML via the (1) min parameter to the Search module, (2) the categories parameter to the FAQ module, or (3) the ltr…
Does this matter?
Lower severity and a low EPSS score (1.73%). Track it; it rarely justifies an emergency change on its own.
Description
Multiple cross-site scripting (XSS) vulnerabilities in PHP-Nuke 6.x to 7.6 allow remote attackers to inject arbitrary web script or HTML via the (1) min parameter to the Search module, (2) the categories parameter to the FAQ module, or (3) the ltr parameter to the Encyclopedia module. NOTE: the bid parameter issue in banners.php is already an item in CVE-2005-1000.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
- EPSS
- 1.73% probability · 76th percentile
- CISA KEV
- Not listed
- Affected
- francisco burzi/php-nuke
- Source
- cve@mitre.org
References
- http://marc.info/?l=bugtraq&m=111263454308478&w=2
- http://www.securityreason.com/adv/PHPNuke%206.x-7.6-p1.txt
- https://exchange.xforce.ibmcloud.com/vulnerabilities/19952
- http://marc.info/?l=bugtraq&m=111263454308478&w=2
- http://www.securityreason.com/adv/PHPNuke%206.x-7.6-p1.txt
- https://exchange.xforce.ibmcloud.com/vulnerabilities/19952
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.