GCVE - cpe:2.3:a:flatnuke:flatnuke:2.5.6:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:flatnuke:flatnuke:2.5.6:*:*:*:*:*:*:*

part: a version: 2.5.6 update: *

Vendor	Flatnuke (`7f78f866-3bad-5926-9b6e-19a719106baf`)
Product	Flatnuke (`296fb107-e20f-566a-8300-8e8a3f8f18cb`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/flatnuke/flatnuke`	purl2cpe	2026-06-01 10:17:16.983745
`pkg:sourceforge/flatnuke`	purl2cpe	2026-06-01 10:17:16.983747

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2006-3608`	vulnerable	2026-06-08 04:49:09.754124	Details available The Gallery module in Simone Vellei Flatnuke 2.5.7 and earlier, when Gallery uploads are enabled, does not restrict the extensions of uploaded files that begin with a GIF header, which allows remote authenticated users to execute arbitrary PHP code via an uploaded .php file. Published: 2006-07-14T21:00:00.000Z Updated: 2024-08-07T18:39:52.576Z Open on db.gcve.eu Reference links http://secunia.com/advisories/21051 http://retrogod.altervista.org/flatnuke257_adv.html http://www.securityfocus.com/archive/1/439975/100/0/threaded http://www.securityfocus.com/archive/1/442421/100/0/threaded http://www.securityfocus.com/bid/18966	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2005-4449`	vulnerable	2026-06-08 04:48:43.875925	Details available verify.php in FlatNuke 2.5.6 allows remote authenticated administrators to modify arbitrary PHP files by setting the file parameter to an arbitrary file and injecting the code into the body parameter. NOTE: if a FlatNuke administrator is normally assumed to be able to modify arbitrary content, then this issue does not cross privilege boundaries and would not be a vulnerability. Published: 2005-12-21T11:00:00.000Z Updated: 2024-08-07T23:46:05.181Z Open on db.gcve.eu Reference links https://exchange.xforce.ibmcloud.com/vulnerabilities/22159 http://cvs.sourceforge.net/viewcvs.py/flatnuke/flatnuke/Changelog?rev=1.78&view=markup http://www.securityfocus.com/archive/1/419107 http://securitytracker.com/id?1015339 http://securityreason.com/securityalert/248	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2005-4448`	vulnerable	2026-06-08 04:48:43.875643	Details available FlatNuke 2.5.6 verifies authentication credentials based on an MD5 checksum of the admin name and the hashed password rather than the plaintext password, which allows attackers to gain privileges by obtaining the password hash (possibly via CVE-2005-2813), then calculating the credentials and including them in the secid cookie. Published: 2005-12-21T11:00:00.000Z Updated: 2024-08-07T23:46:05.503Z Open on db.gcve.eu Reference links https://exchange.xforce.ibmcloud.com/vulnerabilities/22159 http://cvs.sourceforge.net/viewcvs.py/flatnuke/flatnuke/Changelog?rev=1.78&view=markup http://www.securityfocus.com/bid/15796 http://www.securityfocus.com/archive/1/419107 http://securitytracker.com/id?1015339	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2005-4208`	vulnerable	2026-06-08 04:48:43.233383	Details available Directory traversal vulnerability in Flatnuke 2.5.6 allows remote attackers to access arbitrary files via a .. (dot dot) and null byte (%00) in the id parameter of the read module. Published: 2005-12-13T11:00:00.000Z Updated: 2024-08-07T23:38:51.249Z Open on db.gcve.eu Reference links http://www.securityfocus.com/archive/1/419107/100/0/threaded http://www.securityfocus.com/bid/15796 http://securitytracker.com/id?1015339	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2005-3361`	vulnerable	2026-06-08 04:48:40.496556	Details available Cross-site scripting (XSS) vulnerability in forum/index.php in FlatNuke 2.5.6 allows remote attackers to inject arbitrary web script or HTML via the nome parameter in a login operation, a variant of CVE-2005-3306. Published: 2005-10-29T02:22:00.000Z Updated: 2024-08-07T23:10:08.331Z Open on db.gcve.eu Reference links http://marc.info/?l=bugtraq&m=113019486931157&w=2 http://www.vupen.com/english/advisories/2005/2178 http://www.osvdb.org/20246	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2005-3307`	not_vulnerable	2026-06-08 04:48:40.296088	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2005-3306`	vulnerable	2026-06-08 04:48:40.295721	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2005-2815`	vulnerable	2026-06-08 04:48:30.626613	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2005-2814`	vulnerable	2026-06-08 04:48:30.626331	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2005-2813`	vulnerable	2026-06-08 04:48:30.625959	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

FlatNuke 2.5.6

Notes

PURL mappings

Vulnerability references

Contribute