PatchTheCVE: nexusphp projecthttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2017-15305: XSS exists in NexusPHP 1.5 via the keyword parameter to messages.php.https://patchthecve.com/cve/CVE-2017-15305.htmlhttps://patchthecve.com/cve/CVE-2017-15305.htmlWed, 17 Jun 2026 01:07:33 +0000MEDIUM 6.1: XSS exists in NexusPHP 1.5 via the keyword parameter to messages.php.CVE-2017-12792: Multiple cross-site request forgery (CSRF) vulnerabilities in NexusPHP 1.5 allow remote attackers to hijack thhttps://patchthecve.com/cve/CVE-2017-12792.htmlhttps://patchthecve.com/cve/CVE-2017-12792.htmlWed, 17 Jun 2026 01:03:56 +0000MEDIUM 6.1: Multiple cross-site request forgery (CSRF) vulnerabilities in NexusPHP 1.5 allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) linkname, (2) url, or (3) title parameter in an add action to linksmanage.php.CVE-2017-14534: Cross Site Scripting (XSS) exists in NexusPHP 1.5.beta5.20120707 via the PATH_INFO to location.php, related tohttps://patchthecve.com/cve/CVE-2017-14534.htmlhttps://patchthecve.com/cve/CVE-2017-14534.htmlWed, 17 Jun 2026 01:06:20 +0000MEDIUM 6.1: Cross Site Scripting (XSS) exists in NexusPHP 1.5.beta5.20120707 via the PATH_INFO to location.php, related to PHP_SELF.CVE-2017-14512: NexusPHP 1.5.beta5.20120707 has SQL Injection in forummanage.php via the sort parameter in an editforum actionhttps://patchthecve.com/cve/CVE-2017-14512.htmlhttps://patchthecve.com/cve/CVE-2017-14512.htmlWed, 17 Jun 2026 01:06:17 +0000CRITICAL 9.8: NexusPHP 1.5.beta5.20120707 has SQL Injection in forummanage.php via the sort parameter in an editforum action, a different vulnerability than CVE-2017-12981.CVE-2017-14347: NexusPHP 1.5.beta5.20120707 has XSS in the returnto parameter to fun.php in a delete action.https://patchthecve.com/cve/CVE-2017-14347.htmlhttps://patchthecve.com/cve/CVE-2017-14347.htmlWed, 17 Jun 2026 01:05:59 +0000MEDIUM 6.1: NexusPHP 1.5.beta5.20120707 has XSS in the returnto parameter to fun.php in a delete action.CVE-2017-12906: Multiple cross-site scripting (XSS) vulnerabilities in NexusPHP allow remote attackers to inject arbitrary webhttps://patchthecve.com/cve/CVE-2017-12906.htmlhttps://patchthecve.com/cve/CVE-2017-12906.htmlWed, 17 Jun 2026 01:04:07 +0000MEDIUM 6.1: Multiple cross-site scripting (XSS) vulnerabilities in NexusPHP allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) cheaters.php or (2) confirm_resend.php.CVE-2017-12838: Cross-site request forgery (CSRF) vulnerability in NexusPHP 1.5 allows remote attackers to hijack the authentihttps://patchthecve.com/cve/CVE-2017-12838.htmlhttps://patchthecve.com/cve/CVE-2017-12838.htmlWed, 17 Jun 2026 01:04:00 +0000HIGH 8.8: Cross-site request forgery (CSRF) vulnerability in NexusPHP 1.5 allows remote attackers to hijack the authentication of users for requests that (1) send manas via a request to mybonus.php or (2) add administrators via unspecified vectors.CVE-2017-12776: SQL injection vulnerability in reports.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL cohttps://patchthecve.com/cve/CVE-2017-12776.htmlhttps://patchthecve.com/cve/CVE-2017-12776.htmlWed, 17 Jun 2026 01:03:54 +0000CRITICAL 9.8: SQL injection vulnerability in reports.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the delreport parameter.CVE-2017-12680: Cross-Site Scripting (XSS) exists in NexusPHP 1.5 via the type parameter to shoutbox.php.https://patchthecve.com/cve/CVE-2017-12680.htmlhttps://patchthecve.com/cve/CVE-2017-12680.htmlWed, 17 Jun 2026 01:03:47 +0000MEDIUM 6.1: Cross-Site Scripting (XSS) exists in NexusPHP 1.5 via the type parameter to shoutbox.php.CVE-2017-12910: SQL injection vulnerability in massmail.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL chttps://patchthecve.com/cve/CVE-2017-12910.htmlhttps://patchthecve.com/cve/CVE-2017-12910.htmlWed, 17 Jun 2026 01:04:08 +0000CRITICAL 9.8: SQL injection vulnerability in massmail.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the or parameter.CVE-2017-12909: SQL injection vulnerability in modtask.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL cohttps://patchthecve.com/cve/CVE-2017-12909.htmlhttps://patchthecve.com/cve/CVE-2017-12909.htmlWed, 17 Jun 2026 01:04:07 +0000CRITICAL 9.8: SQL injection vulnerability in modtask.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the userid parameter.CVE-2017-12908: SQL injection vulnerability in takeconfirm.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQhttps://patchthecve.com/cve/CVE-2017-12908.htmlhttps://patchthecve.com/cve/CVE-2017-12908.htmlWed, 17 Jun 2026 01:04:07 +0000CRITICAL 9.8: SQL injection vulnerability in takeconfirm.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the conusr parameter.CVE-2017-12907: Cross-Site Scripting (XSS) exists in NexusPHP version v1.5 via the url path to usersearch.php.https://patchthecve.com/cve/CVE-2017-12907.htmlhttps://patchthecve.com/cve/CVE-2017-12907.htmlWed, 17 Jun 2026 01:04:07 +0000MEDIUM 6.1: Cross-Site Scripting (XSS) exists in NexusPHP version v1.5 via the url path to usersearch.php.CVE-2017-12798: Cross-Site Scripting (XSS) exists in NexusPHP version v1.5 via the q parameter to searchsuggest.php.https://patchthecve.com/cve/CVE-2017-12798.htmlhttps://patchthecve.com/cve/CVE-2017-12798.htmlWed, 17 Jun 2026 01:03:57 +0000MEDIUM 6.1: Cross-Site Scripting (XSS) exists in NexusPHP version v1.5 via the q parameter to searchsuggest.php.CVE-2017-12777: Cross-Site Scripting (XSS) exists in NexusPHP version v1.5 via some parameter to usersearch.php.https://patchthecve.com/cve/CVE-2017-12777.htmlhttps://patchthecve.com/cve/CVE-2017-12777.htmlWed, 17 Jun 2026 01:03:54 +0000MEDIUM 6.1: Cross-Site Scripting (XSS) exists in NexusPHP version v1.5 via some parameter to usersearch.php.CVE-2017-12655: Cross-Site Scripting (XSS) exists in NexusPHP version v1.5 via the query parameter to log.php in a dailylog achttps://patchthecve.com/cve/CVE-2017-12655.htmlhttps://patchthecve.com/cve/CVE-2017-12655.htmlWed, 17 Jun 2026 01:03:45 +0000MEDIUM 6.1: Cross-Site Scripting (XSS) exists in NexusPHP version v1.5 via the query parameter to log.php in a dailylog action.