Nexusphp

14 CVEs across 1 Nexusphp products. Browse Nexusphp vulnerabilities, severities, and proof-of-concept exploits.

Nexusphp products with known CVEs

ProductCVEs
Nexusphp14
Nexusphp CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2022-46890Medium4.32023-01-19Weak access control in NexusPHP before 1.7.33 allows a remote authenticated user to edit any post in the forum (this is caused by a lack of checks performed by…
CVE-2022-46889Medium5.42023-01-19A persistent cross-site scripting (XSS) vulnerability in NexusPHP before 1.7.33 allows remote authenticated attackers to permanently inject arbitrary web scrip…
CVE-2022-46888Medium6.12023-01-19Multiple reflective cross-site scripting (XSS) vulnerabilities in NexusPHP before 1.7.33 allow remote attackers to inject arbitrary web script or HTML via the…
CVE-2022-46887Critical9.82023-01-19Multiple SQL injection vulnerabilities in NexusPHP before 1.7.33 allow remote attackers to execute arbitrary SQL commands via the conuser[] parameter in takeco…
CVE-2020-24771High7.52022-03-30Incorrect access control in NexusPHP 1.5.beta5.20120707 allows unauthorized attackers to access published content.
CVE-2020-24770Critical9.82022-03-30SQL injection vulnerability in modrules.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2020-24769Critical9.82022-03-30SQL injection vulnerability in takeconfirm.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the classes parameter.
CVE-2017-14076Critical9.82017-08-31SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the id parameter to linksmanage.php in an editlink action.
CVE-2017-14070Medium6.12017-08-31Cross Site Scripting (XSS) exists in NexusPHP 1.5.beta5.20120707 via the PATH_INFO to ipsearch.php, related to PHP_SELF.
CVE-2017-14069Critical9.82017-08-31SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the usernw array parameter to nowarn.php.
CVE-2017-13669Critical9.82017-08-24SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the setanswered parameter to staffbox.php.
CVE-2017-12679Critical9.82017-08-24SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the delcheater parameter to cheaterbox.php.
CVE-2017-12981Critical9.82017-08-21NexusPHP 1.5.beta5.20120707 has SQL Injection in forummanage.php via the sort parameter in an addforum action.
CVE-2017-11651Medium6.12017-07-26NexusPHP V1.5 has XSS via a javascript: or data: URL in a UBBCode url tag.