Nukeviet

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:nukeviet:nukeviet:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorNukeviet (deafe795-accb-5cbd-ba50-0b5ab2c9742b)
ProductNukeviet (ca2d0760-cfbf-5a7f-8906-f3bb258c250e)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from purl2cpe mapping

PURL mappings

PURLSourceLast updated
pkg:github/nukeviet/nukeviet purl2cpe 2026-06-01 10:12:02.874560
pkg:sourceforge/nukevietcms purl2cpe 2026-06-01 10:12:02.874563

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2025-8772 vulnerable 2026-06-08 07:45:21.130719 Vinades NukeViet Module index.php server-side request forgery
MEDIUM (4.3)
A vulnerability, which was classified as problematic, has been found in Vinades NukeViet up to 4.5.06. This issue affects some unknown processing of the file /admin/index.php?language=en&nv=upload of the component Module Handler. The manipulation leads to server-side request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2025-08-09T19:32:06.289Z
Updated: 2025-08-12T16:04:32.845Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2024-36531 vulnerable 2026-06-08 06:39:45.463214 Details available
nukeviet v.4.5 and before and nukeviet-egov v.1.2.02 and before are vulnerable to arbitrary code execution via the /admin/extensions/upload.php component.
Published: 2024-06-10T00:00:00.000Z
Updated: 2024-08-02T03:37:05.269Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2024-36528 vulnerable 2026-06-08 06:39:45.461543 Details available
nukeviet v.4.5 and before and nukeviet-egov v.1.2.02 and before have a Deserialization vulnerability which results in code execution via /admin/extensions/download.php and /admin/extensions/upload.php.
Published: 2024-06-10T00:00:00.000Z
Updated: 2024-08-21T16:58:47.616Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2022-3975 vulnerable 2026-06-08 05:48:22.746875 NukeViet CMS Data URL Request.php filterAttr cross site scripting
LOW (3.5)
A vulnerability, which was classified as problematic, has been found in NukeViet CMS. Affected by this issue is the function filterAttr of the file vendor/vinades/nukeviet/Core/Request.php of the component Data URL Handler. The manipulation of the argument attrSubSet leads to cross site scripting. The attack may be launched remotely. Upgrading to version 4.5 is able to address this issue. The name of the patch is 0b3197fad950bb3383e83039a8ee4c9509b3ce02. It is recommended to upgrade the affected component. VDB-213554 is the identifier assigned to this vulnerability.
Published: 2022-11-13T00:00:00.000Z
Updated: 2025-04-15T13:14:45.323Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2022-30874 vulnerable 2026-06-08 05:43:39.808150 Details available
There is a Cross Site Scripting Stored (XSS) vulnerability in NukeViet CMS before 4.5.02.
Published: 2022-06-21T14:35:16.000Z
Updated: 2024-08-03T07:03:39.428Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2020-21809 vulnerable 2026-06-08 05:22:31.053891 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2020-21808 vulnerable 2026-06-08 05:22:31.049378 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2019-7726 vulnerable 2026-06-08 05:14:14.685461 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2019-7725 vulnerable 2026-06-08 05:14:14.685011 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.