Nukeviet Nukeviet
14 CVEs affecting Nukeviet Nukeviet. Latest disclosed: 2026-05-22. Critical: 4, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-21809 | Critical | 9.8 | 2021-07-30 | SQL Injection vulnerability in NukeViet CMS module Shops 4.0.29 and 4.3 via the (1) listid parameter in detail.php and the (2) group_price or groupid parameter… |
CVE-2020-21808 | Critical | 9.8 | 2021-07-30 | SQL Injection vulnerability in NukeViet CMS 4.0.10 - 4.3.07 via:the topicsid parameter in modules/news/admin/addtotopics.php. |
CVE-2019-7726 | Critical | 9.8 | 2020-12-31 | modules/banners/funcs/click.php in NukeViet before 4.3.04 has a SQL INSERT statement with raw header data from an HTTP request (e.g., Referer and User-Agent). |
CVE-2019-7725 | Critical | 9.8 | 2020-12-31 | includes/core/is_user.php in NukeViet before 4.3.04 deserializes the untrusted nvloginhash cookie (i.e., the code relies on PHP's serialization format when JSO… |
CVE-2024-36528 | High | 8.8 | 2024-06-10 | nukeviet v.4.5 and before and nukeviet-egov v.1.2.02 and before have a Deserialization vulnerability which results in code execution via /admin/extensions/down… |
CVE-2020-13155 | High | 8.8 | 2020-06-23 | clearsystem.php in NukeViet 4.4 allows CSRF with resultant HTML injection via the deltype parameter to the admin/index.php?nv=webtools&op=clearsystem URI. |
CVE-2026-41147 | High | 8.7 | 2026-05-22 | NukeViet CMS is a multi Content Management System. Versions 4.5.07 and prior contain a Stored Cross-Site Scripting (XSS) vulnerability caused by insufficient s… |
CVE-2020-13157 | Medium | 6.5 | 2020-06-23 | modules\users\admin\edit.php in NukeViet 4.4 allows CSRF to change a user's password via an admin/index.php?nv=users&op=edit&userid= URI. The old password is n… |
CVE-2020-13156 | Medium | 6.5 | 2020-06-23 | modules\users\admin\add_user.php in NukeViet 4.4 allows CSRF to add a user account via the admin/index.php?nv=users&op=user_add URI. |
CVE-2020-22765 | Medium | 6.1 | 2021-07-30 | Cross Site Scripting (XSS) vulnerability in NukeViet cms 4.4.0 via the editor in the News module. |
CVE-2024-36531 | Medium | 5.7 | 2024-06-10 | nukeviet v.4.5 and before and nukeviet-egov v.1.2.02 and before are vulnerable to arbitrary code execution via the /admin/extensions/upload.php component. |
CVE-2022-30874 | Medium | 5.4 | 2022-06-21 | There is a Cross Site Scripting Stored (XSS) vulnerability in NukeViet CMS before 4.5.02. |
CVE-2025-8772 | Medium | 4.3 | 2025-08-09 | A vulnerability, which was classified as problematic, has been found in Vinades NukeViet up to 4.5.06. This issue affects some unknown processing of the file /… |
CVE-2022-3975 | Low | 3.5 | 2022-11-13 | A vulnerability, which was classified as problematic, has been found in NukeViet CMS. Affected by this issue is the function filterAttr of the file vendor/vina… |