Note:
This project will be discontinued after December 13, 2021. [more]
Product:
Php\-Nuke
(Francisco_burzi)| Repositories |
Unknown: This might be proprietary software. |
| #Vulnerabilities | 96 |
| Date | Id | Summary | Products | Score | Patch | Annotated |
|---|---|---|---|---|---|---|
| 2004-04-04 | CVE-2004-1986 | Directory traversal vulnerability in modules.php in Coppermine Photo Gallery 1.2.2b and 1.2.0 RC4 allows remote attackers with administrative privileges to read arbitrary files via a .. (dot dot) in the startdir parameter. | Coppermine_photo_gallery, Php\-Nuke | N/A | ||
| 2004-04-30 | CVE-2004-1985 | Cross-site scripting (XSS) vulnerability in menu.inc.php in Coppermine Photo Gallery 1.2.2b allows remote attackers to inject arbitrary HTML or web script via the CPG_URL parameter. | Coppermine_photo_gallery, Php\-Nuke | N/A | ||
| 2004-05-02 | CVE-2004-1984 | Coppermine Photo Gallery 1.2.2b and 1.2.0 RC4 allows remote attackers to obtain sensitive information via a direct HTTP request to (1) phpinfo.php, (2) addpic.php, (3) config.php, (4) db_input.php, (5) displayecard.php, (6) ecard.php, (7) crop.inc.php, which reveal the full path in a PHP error message. | Coppermine_photo_gallery, Php\-Nuke | N/A | ||
| 2004-04-26 | CVE-2004-1972 | SQL injection vulnerability in modules.php in PHP-Nuke Video Gallery Module 0.1 Beta 5 allows remote attackers to execute arbitrary SQL code via the (1) clipid or (2) catid parameters in a viewclip, viewcat, or voteclip action. | Php\-Nuke | N/A | ||
| 2004-04-12 | CVE-2004-1932 | SQL injection vulnerability in (1) auth.php and (2) admin.php in PHP-Nuke 6.x through 7.2 allows remote attackers to execute arbitrary SQL code and create an administrator account via base64-encoded SQL in the admin parameter. | Php\-Nuke | N/A | ||
| 2004-04-12 | CVE-2004-1930 | Cross-site scripting (XSS) vulnerability in the cookiedecode function in mainfile.php for PHP-Nuke 6.x through 7.2, when themes are used, allows remote attackers to inject arbitrary web script or HTML via a base64-encoded user parameter or cookie. | Php\-Nuke | N/A | ||
| 2004-04-13 | CVE-2004-1929 | SQL injection vulnerability in the bblogin function in functions.php in PHP-Nuke 6.x through 7.2 allows remote attackers to bypass authentication and gain access by injecting base64-encoded SQL code into the user parameter. | Php\-Nuke | N/A | ||
| 2004-12-31 | CVE-2004-1914 | SQL injection vulnerability in modules.php in NukeCalendar 1.1.a, as used in PHP-Nuke, allows remote attackers to execute arbitrary SQL commands via the eid parameter. | Php\-Nuke, Nukecalendar | N/A | ||
| 2004-12-31 | CVE-2004-1913 | Cross-site scripting (XSS) vulnerability in modules.php in NukeCalendar 1.1.a, as used in PHP-Nuke, allows remote attackers to inject arbitrary web script or HTML via the eid parameter. | Php\-Nuke, Nukecalendar | N/A | ||
| 2004-12-31 | CVE-2004-1912 | The (1) modules.php, (2) block-Calendar.php, (3) block-Calendar1.php, (4) block-Calendar_center.php scripts in NukeCalendar 1.1.a, as used in PHP-Nuke, allow remote attackers to obtain sensitive information via a URL with an invalid argument, which reveals the full path in an error message. | Php\-Nuke, Nukecalendar | N/A |