CVE-2005-4260
Interpretation conflict in includes/mainfile.php in PHP-Nuke 7.9 and later allows remote attackers to perform cross-site scripting (XSS) attacks by replacing the ">" in the tag with a "<", which bypasses the regular expressions that sanitize the data,…
Does this matter?
Lower severity and a low EPSS score (2.11%). Track it; it rarely justifies an emergency change on its own.
Description
Interpretation conflict in includes/mainfile.php in PHP-Nuke 7.9 and later allows remote attackers to perform cross-site scripting (XSS) attacks by replacing the ">" in the tag with a "<", which bypasses the regular expressions that sanitize the data, but is automatically corrected by many web browsers. NOTE: it could be argued that this vulnerability is due to a design limitation of many web browsers; if so, then this should not be treated as a vulnerability in PHP-Nuke.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
- EPSS
- 2.11% probability · 81th percentile
- CISA KEV
- Not listed
- Affected
- francisco burzi/php-nuke
- Source
- cve@mitre.org
References
- http://www.securityfocus.com/archive/1/419496/100/0/threaded
- http://www.securityfocus.com/archive/1/419991/100/0/threaded
- http://www.securityfocus.com/bid/15855Exploit
- http://www.securityfocus.com/archive/1/419496/100/0/threaded
- http://www.securityfocus.com/archive/1/419991/100/0/threaded
- http://www.securityfocus.com/bid/15855Exploit
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.