Nexusphp
7 CVEs across 1 Nexusphp products. Browse Nexusphp vulnerabilities, severities, and proof-of-concept exploits.
Nexusphp products with known CVEs
Nexusphp CVEs — newest first| CVE | Severity | Score | Published | Summary |
|---|
CVE-2022-46890 | Medium | 4.3 | 2023-01-19 | Weak access control in NexusPHP before 1.7.33 allows a remote authenticated user to edit any post in the forum (this is caused by a lack of checks performed by… |
CVE-2022-46889 | Medium | 5.4 | 2023-01-19 | A persistent cross-site scripting (XSS) vulnerability in NexusPHP before 1.7.33 allows remote authenticated attackers to permanently inject arbitrary web scrip… |
CVE-2022-46888 | Medium | 6.1 | 2023-01-19 | Multiple reflective cross-site scripting (XSS) vulnerabilities in NexusPHP before 1.7.33 allow remote attackers to inject arbitrary web script or HTML via the… |
CVE-2022-46887 | Critical | 9.8 | 2023-01-19 | Multiple SQL injection vulnerabilities in NexusPHP before 1.7.33 allow remote attackers to execute arbitrary SQL commands via the conuser[] parameter in takeco… |
CVE-2020-24771 | High | 7.5 | 2022-03-30 | Incorrect access control in NexusPHP 1.5.beta5.20120707 allows unauthorized attackers to access published content. |
CVE-2020-24770 | Critical | 9.8 | 2022-03-30 | SQL injection vulnerability in modrules.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the id parameter. |
CVE-2020-24769 | Critical | 9.8 | 2022-03-30 | SQL injection vulnerability in takeconfirm.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the classes parameter. |
CVE-2017-14076 | Critical | 9.8 | 2017-08-31 | SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the id parameter to linksmanage.php in an editlink action. |
CVE-2017-14070 | Medium | 6.1 | 2017-08-31 | Cross Site Scripting (XSS) exists in NexusPHP 1.5.beta5.20120707 via the PATH_INFO to ipsearch.php, related to PHP_SELF. |
CVE-2017-14069 | Critical | 9.8 | 2017-08-31 | SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the usernw array parameter to nowarn.php. |
CVE-2017-13669 | Critical | 9.8 | 2017-08-24 | SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the setanswered parameter to staffbox.php. |
CVE-2017-12679 | Critical | 9.8 | 2017-08-24 | SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the delcheater parameter to cheaterbox.php. |
CVE-2017-12981 | Critical | 9.8 | 2017-08-21 | NexusPHP 1.5.beta5.20120707 has SQL Injection in forummanage.php via the sort parameter in an addforum action. |
CVE-2017-11651 | Medium | 6.1 | 2017-07-26 | NexusPHP V1.5 has XSS via a javascript: or data: URL in a UBBCode url tag. |