PatchTheCVE: nexusphphttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2022-46890: Weak access control in NexusPHP before 1.7.33 allows a remote authenticated user to edit any post in the forumhttps://patchthecve.com/cve/CVE-2022-46890.htmlhttps://patchthecve.com/cve/CVE-2022-46890.htmlWed, 17 Jun 2026 05:12:38 +0000MEDIUM 4.3: Weak access control in NexusPHP before 1.7.33 allows a remote authenticated user to edit any post in the forum (this is caused by a lack of checks performed by the /forums.php?action=post page).CVE-2022-46889: A persistent cross-site scripting (XSS) vulnerability in NexusPHP before 1.7.33 allows remote authenticated athttps://patchthecve.com/cve/CVE-2022-46889.htmlhttps://patchthecve.com/cve/CVE-2022-46889.htmlWed, 17 Jun 2026 05:12:37 +0000MEDIUM 5.4: A persistent cross-site scripting (XSS) vulnerability in NexusPHP before 1.7.33 allows remote authenticated attackers to permanently inject arbitrary web script or HTML via the title parameter used in /subtitles.php.CVE-2022-46888: Multiple reflective cross-site scripting (XSS) vulnerabilities in NexusPHP before 1.7.33 allow remote attackerhttps://patchthecve.com/cve/CVE-2022-46888.htmlhttps://patchthecve.com/cve/CVE-2022-46888.htmlWed, 17 Jun 2026 05:12:37 +0000MEDIUM 6.1: Multiple reflective cross-site scripting (XSS) vulnerabilities in NexusPHP before 1.7.33 allow remote attackers to inject arbitrary web script or HTML via the secret parameter in /login.php; q parameter in /user-ban-log.php; query parameter in /log.php; text parameter in /moresmiles.php; q parameterCVE-2022-46887: Multiple SQL injection vulnerabilities in NexusPHP before 1.7.33 allow remote attackers to execute arbitrary Shttps://patchthecve.com/cve/CVE-2022-46887.htmlhttps://patchthecve.com/cve/CVE-2022-46887.htmlWed, 17 Jun 2026 05:12:37 +0000CRITICAL 9.8: Multiple SQL injection vulnerabilities in NexusPHP before 1.7.33 allow remote attackers to execute arbitrary SQL commands via the conuser[] parameter in takeconfirm.php; the delcheater parameter in cheaterbox.php; or the usernw parameter in nowarn.php.