postnuke vulnerabilities and fixes

Recent CVEs affecting postnuke, with upgrade or downgrade steps. 42 tracked.

postnuke has 42 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 5. Most recent: 2010-05-04. Highest priority: CVE-2006-0147 (score 55/100).

• CVE-2010-1713 HIGH 7.5 DOWNGRADE SQL injection vulnerability in modules.php in PostNuke 0.764 allows remote attackers to execute arbitrary SQL
• CVE-2008-1591 HIGH 7.5 UPGRADE The pnVarPrepForStore function in PostNuke 0.764 and earlier skips input sanitization when magic_quotes_runtim
• CVE-2007-0386 HIGH 10.0 DOWNGRADE Unspecified vulnerability in the rating section in PostNuke 0.764 has unknown impact and attack vectors, relat
• CVE-2007-0385 HIGH 7.8 DOWNGRADE The faq section in PostNuke 0.764 allows remote attackers to obtain sensitive information (the full path) via
• CVE-2007-0384 MEDIUM 5.1 DOWNGRADE Cross-site scripting (XSS) vulnerability in preview in the reviews section in PostNuke 0.764 allows remote att
• CVE-2006-6267 HIGH 7.8 DOWNGRADE PostNuke 0.7.5.0, and certain minor versions, allows remote attackers to obtain sensitive information via a no
• CVE-2006-6233 HIGH 7.5 DOWNGRADE SQL injection vulnerability in the Downloads module for unknown versions of PostNuke allows remote attackers t
• CVE-2006-5733 HIGH 7.5 UPGRADE Directory traversal vulnerability in error.php in PostNuke 0.763 and earlier allows remote attackers to includ
• CVE-2006-5121 HIGH 7.5 DOWNGRADE SQL injection vulnerability in modules/Downloads/admin.php in the Admin section of PostNuke 0.762 allows remot
• CVE-2006-0802 LOW 2.6 UPGRADE Cross-site scripting (XSS) vulnerability in the NS-Languages module for PostNuke 0.761 and earlier, when magic
• CVE-2006-0801 MEDIUM 5.1 UPGRADE SQL injection vulnerability in the NS-Languages module for PostNuke 0.761 and earlier, when magic_quotes_gpc i
• CVE-2006-0800 LOW 2.6 DOWNGRADE Interpretation conflict in PostNuke 0.761 and earlier allows remote attackers to conduct cross-site scripting
• CVE-2006-0147 HIGH 7.5 DOWNGRADE DOWNGRADE Dynamic code evaluation vulnerability in tests/tmssql.php test script in ADOdb for PHP before 4.70, as used in
• CVE-2006-0146 HIGH 7.5 DOWNGRADE DOWNGRADE The server.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2
• CVE-2005-2690 HIGH 7.5 DOWNGRADE SQL injection vulnerability in the Downloads module in PostNuke 0.760-RC4b allows PostNuke administrators to e
• CVE-2005-2689 LOW 2.6 DOWNGRADE Multiple cross-site scripting (XSS) vulnerabilities in PostNuke 0.760-RC4b allows remote attackers to inject a
• CVE-2005-1778 LOW 2.6 DOWNGRADE Cross-site scripting (XSS) vulnerability in readpmsg.php in PostNuke 0.750 allows remote attackers to inject a
• CVE-2005-1777 HIGH 7.5 DOWNGRADE SQL injection vulnerability in readpmsg.php in PostNuke 0.750 allows remote attackers to execute arbitrary SQL
• CVE-2005-1700 HIGH 7.5 DOWNGRADE SQL injection vulnerability in pnadmin.php in the Xanthia module in PostNuke 0.760-RC3 allows remote administr
• CVE-2005-1699 MEDIUM 4.0 DOWNGRADE Directory traversal vulnerability in pnadminapi.php in the Xanthia module in PostNuke 0.760-RC3 allows remote
• CVE-2005-1698 MEDIUM 5.0 DOWNGRADE PostNuke 0.750 and 0.760RC3 allows remote attackers to obtain sensitive information via a direct request to (1
• CVE-2005-1697 MEDIUM 5.0 DOWNGRADE The RSS module in PostNuke 0.750 and 0.760RC2 and RC3 allows remote attackers to obtain sensitive information
• CVE-2005-1696 LOW 2.6 DOWNGRADE Multiple cross-site scripting (XSS) vulnerabilities in PostNuke 0.750 and 0.760RC3 allow remote attackers to i
• CVE-2005-1695 LOW 2.6 DOWNGRADE Multiple cross-site scripting (XSS) vulnerabilities in the RSS module in PostNuke 0.750 and 0.760RC2 and RC3 a
• CVE-2005-1694 HIGH 7.5 DOWNGRADE Multiple SQL injection vulnerabilities in Xanthia.php in the Xanthia module in PostNuke 0.750 allow remote att
• CVE-2005-1621 MEDIUM 5.0 DOWNGRADE Directory traversal vulnerability in the pnModFunc function in pnMod.php for PostNuke 0.750 through 0.760rc4 a
• CVE-2005-1050 MEDIUM 5.0 DOWNGRADE The modload op in the Reviews module for PostNuke 0.760-RC3 allows remote attackers to obtain sensitive inform
• CVE-2005-1049 LOW 2.6 DOWNGRADE Multiple cross-site scripting vulnerabilities in PostNuke 0.760-RC3 allow remote attackers to inject arbitrary
• CVE-2005-1048 HIGH 7.5 DOWNGRADE SQL injection vulnerability in modules.php in PostNuke 0.760 RC3 allows remote attackers to execute arbitrary
• CVE-2005-0617 HIGH 7.5 DOWNGRADE SQL injection vulnerability in dl-search.php in PostNuke 0.750 and 0.760-RC2 allows remote attackers to execut
• CVE-2005-0615 HIGH 7.5 DOWNGRADE Multiple SQL injection vulnerabilities in (1) index.php, (2) modules.php, or (3) admin.php in PostNuke 0.760-R
• CVE-2004-2752 MEDIUM 4.3 DOWNGRADE Cross-site scripting (XSS) vulnerability in the Downloads module in PostNuke up to 0.726, and possibly later v
• CVE-2004-2751 MEDIUM 6.8 DOWNGRADE SQL injection vulnerability in the members_list module in PostNuke 0.726, and possibly earlier, allows remote
• CVE-2004-1956 MEDIUM 5.0 DOWNGRADE PostNuke 0.7.2.6 allows remote attackers to gain information via a direct HTTP request to files in the (1) inc
• CVE-2004-1949 HIGH 7.5 DOWNGRADE SQL injection vulnerability in PostNuke 7.2.6 and earlier allows remote attackers to execute arbitrary SQL via
• CVE-2003-1537 MEDIUM 5.0 UPGRADE Directory traversal vulnerability in PostNuke 0.723 and earlier allows remote attackers to include arbitrary f
• CVE-2002-2015 HIGH 7.5 DOWNGRADE PHP file inclusion vulnerability in user.php in PostNuke 0.703 allows remote attackers to include arbitrary fi
• CVE-2002-1996 LOW 2.6 DOWNGRADE Cross-site scripting (XSS) vulnerability in PostNuke 0.71 and earlier allows remote attackers to inject arbitr
• CVE-2002-0535 MEDIUM 5.0 DOWNGRADE DOWNGRADE Cross-site scripting vulnerabilities in PostBoard 2.0.1 and earlier allows remote attackers to execute script
• CVE-2001-1521 LOW 2.6 DOWNGRADE Cross-site scripting (XSS) vulnerability in user.php in PostNuke 0.64 allows remote attackers to inject arbitr
• CVE-2001-1460 HIGH 7.5 DOWNGRADE SQL injection vulnerability in article.php in PostNuke 0.62 through 0.64 allows remote attackers to bypass aut
• CVE-2001-0911 HIGH 7.5 DOWNGRADE DOWNGRADE PHP-Nuke 5.1 stores user and administrator passwords in a base-64 encoded cookie, which could allow remote att

FAQ

How do I fix postnuke vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is postnuke being exploited right now?

None of the tracked postnuke CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which postnuke CVE should I patch first?

CVE-2006-0147 currently ranks highest (55/100): Dynamic code evaluation vulnerability in tests/tmssql.php test script in ADOdb for PHP before 4.70, as used in.

RSS feed for postnuke · ← Back to latest CVEs