https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2008-0461.htmlhttps://patchthecve.com/cve/CVE-2008-0461.htmlTue, 16 Jun 2026 22:49:41 +0000MEDIUM 6.8: SQL injection vulnerability in index.php in the Search module in PHP-Nuke 8.0 FINAL and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the sid parameter in a comments action to modules.php. NOTE: some of these details are obtained from thirhttps://patchthecve.com/cve/CVE-2007-6376.htmlhttps://patchthecve.com/cve/CVE-2007-6376.htmlTue, 16 Jun 2026 22:47:56 +0000HIGH 7.5: Directory traversal vulnerability in autohtml.php in Francisco Burzi PHP-Nuke 8.0 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the filename parameter, a different vector than CVE-2006-4190. NOTE: the provenance of this information is unknown; the detailhttps://patchthecve.com/cve/CVE-2007-5032.htmlhttps://patchthecve.com/cve/CVE-2007-5032.htmlTue, 16 Jun 2026 22:45:19 +0000MEDIUM 5.1: Cross-site request forgery (CSRF) vulnerability in admin.php in Francisco Burzi PHP-Nuke allows remote attackers to add administrative accounts via an AddAuthor action with modified add_name and add_radminsuper parameters.https://patchthecve.com/cve/CVE-2007-1061.htmlhttps://patchthecve.com/cve/CVE-2007-1061.htmlTue, 16 Jun 2026 22:36:51 +0000MEDIUM 6.8: SQL injection vulnerability in index.php in Francisco Burzi PHP-Nuke 8.0 Final and earlier, when the "HTTP Referers" block is enabled, allows remote attackers to execute arbitrary SQL commands via the HTTP Referer header (HTTP_REFERER variable).https://patchthecve.com/cve/CVE-2007-0372.htmlhttps://patchthecve.com/cve/CVE-2007-0372.htmlTue, 16 Jun 2026 22:35:26 +0000HIGH 7.5: Multiple SQL injection vulnerabilities in Francisco Burzi PHP-Nuke 7.9 allow remote attackers to execute arbitrary SQL commands via (1) the active parameter in admin/modules/modules.php; the (2) ad_class, (3) imageurl, (4) clickurl, (5) ad_code, or (6) position parameter in modules/Advertising/adminhttps://patchthecve.com/cve/CVE-2007-0309.htmlhttps://patchthecve.com/cve/CVE-2007-0309.htmlTue, 16 Jun 2026 22:35:19 +0000HIGH 7.5: SQL injection vulnerability in blocks/block-Old_Articles.php in Francisco Burzi PHP-Nuke 7.9 and earlier, when register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the cat parameter.https://patchthecve.com/cve/CVE-2006-6234.htmlhttps://patchthecve.com/cve/CVE-2006-6234.htmlTue, 16 Jun 2026 22:32:43 +0000HIGH 7.5: Multiple SQL injection vulnerabilities in the Content module in PHP-Nuke 6.0, and possibly other versions, allow remote attackers to execute arbitrary SQL commands via (1) the cid parameter in a list_pages_categories action or (2) the pid parameter in a showpage action.https://patchthecve.com/cve/CVE-2006-6200.htmlhttps://patchthecve.com/cve/CVE-2006-6200.htmlTue, 16 Jun 2026 22:32:40 +0000HIGH 7.5: Multiple SQL injection vulnerabilities in the (1) rate_article and (2) rate_complete functions in modules/News/index.php in the News module in Francisco Burzi PHP-Nuke 7.9 and earlier, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the sid parameter.https://patchthecve.com/cve/CVE-2006-5720.htmlhttps://patchthecve.com/cve/CVE-2006-5720.htmlTue, 16 Jun 2026 22:31:42 +0000HIGH 7.5: SQL injection vulnerability in modules/journal/search.php in the Journal module in Francisco Burzi PHP-Nuke 7.9 and earlier allows remote attackers to execute arbitrary SQL commands via the forwhat parameter.https://patchthecve.com/cve/CVE-2006-1847.htmlhttps://patchthecve.com/cve/CVE-2006-1847.htmlTue, 16 Jun 2026 22:23:47 +0000HIGH 7.5: SQL injection vulnerability in the Your_Account module in PHP-Nuke 7.8 might allows remote attackers to execute arbitrary SQL commands via the user_id parameter in the Your_Home functionality. NOTE: the provenance of this information is unknown; the details are obtained solely from third party infohttps://patchthecve.com/cve/CVE-2006-1846.htmlhttps://patchthecve.com/cve/CVE-2006-1846.htmlTue, 16 Jun 2026 22:23:47 +0000MEDIUM 4.3: Cross-site scripting (XSS) vulnerability in the Your_Account module in PHP-Nuke 7.8 might allows remote attackers to inject arbitrary HTML and web script via the ublock parameter, which is saved in the user's personal menu. NOTE: the provenance of this information is unknown; the details are obtainhttps://patchthecve.com/cve/CVE-2006-0908.htmlhttps://patchthecve.com/cve/CVE-2006-0908.htmlTue, 16 Jun 2026 22:21:32 +0000HIGH 7.5: PHP-Nuke 7.8 Patched 3.2 allows remote attackers to bypass SQL injection protection mechanisms via /%2a (/*) sequences with the "ad_click" word in the query string, as demonstrated via the kala parameter.https://patchthecve.com/cve/CVE-2006-0907.htmlhttps://patchthecve.com/cve/CVE-2006-0907.htmlTue, 16 Jun 2026 22:21:32 +0000HIGH 7.5: SQL injection vulnerability in PHP-Nuke before 7.8 Patched 3.2 allows remote attackers to execute arbitrary SQL commands via encoded /%2a (/*) sequences in the query string, which bypasses regular expressions that are intended to protect against SQL injection, as demonstrated via the kala parameter.https://patchthecve.com/cve/CVE-2006-0805.htmlhttps://patchthecve.com/cve/CVE-2006-0805.htmlTue, 16 Jun 2026 22:21:19 +0000HIGH 7.5: The CAPTCHA functionality in php-Nuke 6.0 through 7.9 uses fixed challenge/response pairs that only vary once per day based on the User Agent (HTTP_USER_AGENT), which allows remote attackers to bypass CAPTCHA controls by fixing the User Agent, performing a valid challenge/response, then replaying thhttps://patchthecve.com/cve/CVE-2006-0679.htmlhttps://patchthecve.com/cve/CVE-2006-0679.htmlTue, 16 Jun 2026 22:21:04 +0000HIGH 7.5: SQL injection vulnerability in index.php in the Your_Account module in PHP-Nuke 7.8 and earlier allows remote attackers to execute arbitrary SQL commands via the username variable (Nickname field).https://patchthecve.com/cve/CVE-2006-0676.htmlhttps://patchthecve.com/cve/CVE-2006-0676.htmlTue, 16 Jun 2026 22:21:03 +0000MEDIUM 4.3: Cross-site scripting (XSS) vulnerability in header.php in PHP-Nuke 6.0 to 7.8 allows remote attackers to inject arbitrary web script or HTML via the pagetitle parameter.https://patchthecve.com/cve/CVE-2006-0163.htmlhttps://patchthecve.com/cve/CVE-2006-0163.htmlTue, 16 Jun 2026 22:20:01 +0000HIGH 7.5: SQL injection vulnerability in the search module (modules/Search/index.php) of PHPNuke EV 7.7 -R1 allows remote attackers to execute arbitrary SQL commands via the query parameter, which is used by the search field. NOTE: This is a different vulnerability than CVE-2005-3792.https://patchthecve.com/cve/CVE-2005-4715.htmlhttps://patchthecve.com/cve/CVE-2005-4715.htmlTue, 16 Jun 2026 22:19:17 +0000HIGH 7.5: Multiple SQL injection vulnerabilities in modules.php in PHP-Nuke 7.8, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) name, (2) sid, and (3) pid parameters in a POST request, which bypasses security checks that are performed for GET requests.https://patchthecve.com/cve/CVE-2005-4260.htmlhttps://patchthecve.com/cve/CVE-2005-4260.htmlTue, 16 Jun 2026 22:18:28 +0000MEDIUM 4.3: Interpretation conflict in includes/mainfile.php in PHP-Nuke 7.9 and later allows remote attackers to perform cross-site scripting (XSS) attacks by replacing the ">" in the tag with a "<", which bypasses the regular expressions that sanitize the data, but is automatically corrected by many web browshttps://patchthecve.com/cve/CVE-2005-3792.htmlhttps://patchthecve.com/cve/CVE-2005-3792.htmlTue, 16 Jun 2026 22:17:38 +0000HIGH 7.5: Multiple SQL injection vulnerabilities in the Search module in PHP-Nuke 7.8, and possibly other versions before 7.9 with patch 3.1, allows remote attackers to execute arbitrary SQL commands, as demonstrated via the query parameter in a stories type.https://patchthecve.com/cve/CVE-2005-3304.htmlhttps://patchthecve.com/cve/CVE-2005-3304.htmlTue, 16 Jun 2026 22:16:41 +0000HIGH 7.5: Multiple SQL injection vulnerabilities in PHP-Nuke 7.8 allow remote attackers to modify SQL queries and execute arbitrary PHP code via (1) the username parameter in the Your Account page, (2) the url parameter in the Downloads module, and (3) the description parameter in the Web_Links module.https://patchthecve.com/cve/CVE-2005-3016.htmlhttps://patchthecve.com/cve/CVE-2005-3016.htmlTue, 16 Jun 2026 22:16:05 +0000HIGH 10.0: Multiple unspecified vulnerabilities in the WYSIWYG editor in PHP-Nuke before 7.9 Final have unknown impact and attack vectors.https://patchthecve.com/cve/CVE-2005-1386.htmlhttps://patchthecve.com/cve/CVE-2005-1386.htmlTue, 16 Jun 2026 22:12:57 +0000MEDIUM 5.0: PHP-Nuke 7.6 and earlier allows remote attackers to obtain sensitive information via a direct request to (1) ipban.php, (2) db.php, (3) lang-norwegian.php, (4) lang-indonesian.php, (5) lang-greek.php, (6) a request to Web_Links with the portuguese language (lang-portuguese.php), (7) a request to Webhttps://patchthecve.com/cve/CVE-2005-1180.htmlhttps://patchthecve.com/cve/CVE-2005-1180.htmlTue, 16 Jun 2026 22:12:36 +0000MEDIUM 5.0: HTTP Response Splitting vulnerability in the Surveys module in PHP-Nuke 7.6 allows remote attackers to spoof web content and poison web caches via hex-encoded CRLF ("%0d%0a") sequences in the forwarder parameter.https://patchthecve.com/cve/CVE-2005-1027.htmlhttps://patchthecve.com/cve/CVE-2005-1027.htmlTue, 16 Jun 2026 22:12:18 +0000MEDIUM 4.3: Multiple cross-site scripting (XSS) vulnerabilities in PHP-Nuke 6.x through 7.6 allow remote attackers to inject arbitrary web script or HTML via the (1) username parameter in the Your_Account module, (2) avatarcategory parameter in the Your_Account module, or (3) lid parameter in the Downloads moduhttps://patchthecve.com/cve/CVE-2005-1024.htmlhttps://patchthecve.com/cve/CVE-2005-1024.htmlTue, 16 Jun 2026 22:12:17 +0000MEDIUM 5.0: modules.php in PHP-Nuke 6.x to 7.6 allows remote attackers to obtain sensitive information via a direct request to (1) my_headlines, (2) userinfo, or (3) search, which reveals the path in a PHP error message.https://patchthecve.com/cve/CVE-2005-1023.htmlhttps://patchthecve.com/cve/CVE-2005-1023.htmlTue, 16 Jun 2026 22:12:17 +0000MEDIUM 4.3: Multiple cross-site scripting (XSS) vulnerabilities in PHP-Nuke 6.x to 7.6 allow remote attackers to inject arbitrary web script or HTML via the (1) min parameter to the Search module, (2) the categories parameter to the FAQ module, or (3) the ltr parameter to the Encyclopedia module. NOTE: the bidhttps://patchthecve.com/cve/CVE-2005-1001.htmlhttps://patchthecve.com/cve/CVE-2005-1001.htmlTue, 16 Jun 2026 22:12:15 +0000MEDIUM 5.0: PHP-Nuke 7.6 allows remote attackers to obtain sensitive information via direct requests to (1) the Surveys module with the file parameter set to comments or (2) 3D-Fantasy/theme.php, which leaks the full pathname of the web server in a PHP error message.https://patchthecve.com/cve/CVE-2005-1000.htmlhttps://patchthecve.com/cve/CVE-2005-1000.htmlTue, 16 Jun 2026 22:12:15 +0000MEDIUM 4.3: Multiple cross-site scripting (XSS) vulnerabilities in PHP-Nuke 7.6 allow remote attackers to inject arbitrary web script or HTML via (1) the bid parameter to the EmailStats op in banners.pgp, (2) the ratenum parameter in the TopRated and MostPopular actions in the Web_Links module, (3) the ttitle phttps://patchthecve.com/cve/CVE-2005-0999.htmlhttps://patchthecve.com/cve/CVE-2005-0999.htmlTue, 16 Jun 2026 22:12:11 +0000HIGH 7.5: SQL injection vulnerability in the Top module for PHP-Nuke 6.x through 7.6 allows remote attackers to execute arbitrary SQL commands via the querylang parameter.https://patchthecve.com/cve/CVE-2005-0998.htmlhttps://patchthecve.com/cve/CVE-2005-0998.htmlTue, 16 Jun 2026 22:12:11 +0000MEDIUM 5.0: The Web_Links module for PHP-Nuke 7.6 allows remote attackers to obtain sensitive information via an invalid show parameter, which triggers a division by zero PHP error that leaks the full pathname of the server.https://patchthecve.com/cve/CVE-2005-0997.htmlhttps://patchthecve.com/cve/CVE-2005-0997.htmlTue, 16 Jun 2026 22:12:11 +0000HIGH 7.5: Multiple SQL injection vulnerabilities in the Web_Links module for PHP-Nuke 7.6 allow remote attackers to execute arbitrary SQL commands via (1) the email or url parameters in the Add function, (2) the url parameter in the modifylinkrequestS function, (3) the orderby or min parameters in the viewlinhttps://patchthecve.com/cve/CVE-2005-0996.htmlhttps://patchthecve.com/cve/CVE-2005-0996.htmlTue, 16 Jun 2026 22:12:11 +0000MEDIUM 5.0: Multiple SQL injection vulnerabilities in the Downloads module for PHP-Nuke 7.6 allow remote attackers to inject arbitrary web script or HTML via (1) the email or url parameters in the Add function, (2) the min parameter in the viewsdownload function, or (3) the min parameter in the search function.https://patchthecve.com/cve/CVE-2005-0434.htmlhttps://patchthecve.com/cve/CVE-2005-0434.htmlTue, 16 Jun 2026 22:11:06 +0000MEDIUM 4.3: Multiple cross-site scripting (XSS) vulnerabilities in Php-Nuke 7.5 allow remote attackers to inject arbitrary HTML or web script via (1) the newdownloadshowdays parameter in a NewDownloads operation or (2) the newlinkshowdays parameter in a NewLinks operation.https://patchthecve.com/cve/CVE-2005-0433.htmlhttps://patchthecve.com/cve/CVE-2005-0433.htmlTue, 16 Jun 2026 22:11:05 +0000MEDIUM 5.0: Php-Nuke 7.5 allows remote attackers to determine the full path of the web server via invalid or missing arguments to (1) db.php, (2) mainfile.php, (3) Downloads/index.php, or (4) Web_Links/index.php, which lists the path in a PHP error message.https://patchthecve.com/cve/CVE-2004-2354.htmlhttps://patchthecve.com/cve/CVE-2004-2354.htmlTue, 16 Jun 2026 22:09:30 +0000MEDIUM 6.8: SQL injection vulnerability in 4nGuestbook 0.92 for PHP-Nuke 6.5 through 6.9 allows remote attackers to modify SQL statements via the entry parameter to modules.php, which can also facilitate cross-site scripting (XSS) attacks when MySQL errors are triggered.https://patchthecve.com/cve/CVE-2004-2297.htmlhttps://patchthecve.com/cve/CVE-2004-2297.htmlTue, 16 Jun 2026 22:09:23 +0000MEDIUM 5.0: The Reviews module in PHP-Nuke 6.0 to 7.3 allows remote attackers to cause a denial of service (CPU and memory consumption) via a large, out-of-range score parameter.https://patchthecve.com/cve/CVE-2004-2296.htmlhttps://patchthecve.com/cve/CVE-2004-2296.htmlTue, 16 Jun 2026 22:09:23 +0000MEDIUM 5.0: The preview_review function in the Reviews module in PHP-Nuke 6.0 to 7.3, when running on Windows systems, allows remote attackers to obtain sensitive information via an invalid date parameter, which generates an error message.https://patchthecve.com/cve/CVE-2004-2294.htmlhttps://patchthecve.com/cve/CVE-2004-2294.htmlTue, 16 Jun 2026 22:09:23 +0000MEDIUM 4.3: Canonicalize-before-filter error in the send_review function in the Reviews module for PHP-Nuke 6.0 to 7.3 allows remote attackers to inject arbitrary web script or HTML via hex-encoded XSS sequences in the text parameter, which is checked for dangerous sequences before it is canonicalized, leading https://patchthecve.com/cve/CVE-2004-2293.htmlhttps://patchthecve.com/cve/CVE-2004-2293.htmlTue, 16 Jun 2026 22:09:23 +0000MEDIUM 4.3: Multiple cross-site scripting (XSS) vulnerabilities in PHP-Nuke 6.0 to 7.3 allow remote attackers to inject arbitrary web script or HTML via the (1) eid parameter or (2) query parameter to the Encyclopedia module, (3) preview_review function in the Reviews module as demonstrated by the url, cover, rhttps://patchthecve.com/cve/CVE-2004-2020.htmlhttps://patchthecve.com/cve/CVE-2004-2020.htmlTue, 16 Jun 2026 22:08:50 +0000MEDIUM 4.3: Multiple cross-site scripting (XSS) vulnerabilities in Php-Nuke 6.x through 7.3 allow remote attackers to inject arbitrary HTML or web script into the (1) optionbox parameter in the News module, (2) date parameter in the Statistics module, (3) year, month, and month_1 parameters in the Stories_Archihttps://patchthecve.com/cve/CVE-2004-2019.htmlhttps://patchthecve.com/cve/CVE-2004-2019.htmlTue, 16 Jun 2026 22:08:50 +0000MEDIUM 5.0: The WebLinks module in Php-Nuke 6.x through 7.3 allows remote attackers to obtain sensitive information via an invalid show parameter, which displays the full path in a PHP error message.https://patchthecve.com/cve/CVE-2004-2018.htmlhttps://patchthecve.com/cve/CVE-2004-2018.htmlTue, 16 Jun 2026 22:08:50 +0000HIGH 7.5: PHP remote file inclusion vulnerability in index.php in Php-Nuke 6.x through 7.3 allows remote attackers to execute arbitrary PHP code by modifying the modpath parameter to reference a URL on a remote web server that contains the code.https://patchthecve.com/cve/CVE-2004-1914.htmlhttps://patchthecve.com/cve/CVE-2004-1914.htmlTue, 16 Jun 2026 22:08:38 +0000HIGH 7.5: SQL injection vulnerability in modules.php in NukeCalendar 1.1.a, as used in PHP-Nuke, allows remote attackers to execute arbitrary SQL commands via the eid parameter.https://patchthecve.com/cve/CVE-2004-1913.htmlhttps://patchthecve.com/cve/CVE-2004-1913.htmlTue, 16 Jun 2026 22:08:38 +0000MEDIUM 4.3: Cross-site scripting (XSS) vulnerability in modules.php in NukeCalendar 1.1.a, as used in PHP-Nuke, allows remote attackers to inject arbitrary web script or HTML via the eid parameter.https://patchthecve.com/cve/CVE-2004-1912.htmlhttps://patchthecve.com/cve/CVE-2004-1912.htmlTue, 16 Jun 2026 22:08:38 +0000MEDIUM 5.0: The (1) modules.php, (2) block-Calendar.php, (3) block-Calendar1.php, (4) block-Calendar_center.php scripts in NukeCalendar 1.1.a, as used in PHP-Nuke, allow remote attackers to obtain sensitive information via a URL with an invalid argument, which reveals the full path in an error message.https://patchthecve.com/cve/CVE-2004-0269.htmlhttps://patchthecve.com/cve/CVE-2004-0269.htmlTue, 16 Jun 2026 22:05:17 +0000MEDIUM 6.4: SQL injection vulnerability in PHP-Nuke 6.9 and earlier, and possibly 7.x, allows remote attackers to inject arbitrary SQL code and gain sensitive information via (1) the category variable in the Search module or (2) the admin variable in the Web_Links module.https://patchthecve.com/cve/CVE-2004-0266.htmlhttps://patchthecve.com/cve/CVE-2004-0266.htmlTue, 16 Jun 2026 22:05:17 +0000MEDIUM 5.0: SQL injection vulnerability in the "public message" capability (public_message) for Php-Nuke 6.x to 7.1.0 allows remote attackers to obtain the administrator password via the c_mid parameter.https://patchthecve.com/cve/CVE-2004-0265.htmlhttps://patchthecve.com/cve/CVE-2004-0265.htmlTue, 16 Jun 2026 22:05:17 +0000MEDIUM 6.8: Cross-site scripting (XSS) vulnerability in modules.php for Php-Nuke 6.x-7.1.0 allows remote attackers to execute arbitrary script as other users via URL-encoded (1) title or (2) fname parameters in the News or Reviews modules.https://patchthecve.com/cve/CVE-2004-0738.htmlhttps://patchthecve.com/cve/CVE-2004-0738.htmlTue, 16 Jun 2026 22:06:15 +0000HIGH 7.5: Multiple SQL injection vulnerabilities in the Search module in Php-Nuke allow remote attackers to execute arbitrary SQL via the (1) min or (2) categ parameters.