GCVE - cpe:2.3:a:francisco_burzi:php-nuke:5.5:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:francisco_burzi:php-nuke:5.5:*:*:*:*:*:*:*

part: a version: 5.5 update: *

Vendor	Francisco Burzi (`68a17156-e3a7-5e29-9915-44b46e54976e`)
Product	Php Nuke (`ef4ae9c3-13ee-5006-91f7-f834bb9c94f4`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/phpnuke/phpnuke`	purl2cpe	2026-06-01 10:16:39.150337

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2004-2044`	vulnerable	2026-06-08 04:48:08.386435	Details available PHP-Nuke 7.3, and other products that use the PHP-Nuke codebase such as the Nuke Cops betaNC PHP-Nuke Bundle, OSCNukeLite 3.1, and OSC2Nuke 7x do not properly use the eregi() PHP function with $_SERVER['PHP_SELF'] to identify the calling script, which allows remote attackers to directly access scripts, obtain path information via a PHP error message, and possibly gain access, as demonstrated using an HTTP request that contains the "admin.php" string. Published: 2005-05-10T04:00:00.000Z Updated: 2024-08-08T01:15:01.619Z Open on db.gcve.eu Reference links http://archives.neohapsis.com/archives/bugtraq/2004-06/0005.html https://exchange.xforce.ibmcloud.com/vulnerabilities/16298 http://archives.neohapsis.com/archives/bugtraq/2004-06/0006.html https://exchange.xforce.ibmcloud.com/vulnerabilities/16294 https://exchange.xforce.ibmcloud.com/vulnerabilities/16297	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2004-1929`	vulnerable	2026-06-08 04:48:08.053894	Details available SQL injection vulnerability in the bblogin function in functions.php in PHP-Nuke 6.x through 7.2 allows remote attackers to bypass authentication and gain access by injecting base64-encoded SQL code into the user parameter. Published: 2005-05-10T04:00:00.000Z Updated: 2024-08-08T01:07:49.075Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/10135 http://secunia.com/advisories/11347 http://marc.info/?l=bugtraq&m=108180111826852&w=2 http://www.waraxe.us/index.php?modname=sa&id=17 https://exchange.xforce.ibmcloud.com/vulnerabilities/15839	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2004-0269`	vulnerable	2026-06-08 04:47:49.258423	Details available SQL injection vulnerability in PHP-Nuke 6.9 and earlier, and possibly 7.x, allows remote attackers to inject arbitrary SQL code and gain sensitive information via (1) the category variable in the Search module or (2) the admin variable in the Web_Links module. Published: 2004-03-18T05:00:00.000Z Updated: 2024-08-08T00:10:03.855Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/9630 http://marc.info/?l=bugtraq&m=107643348117646&w=2 https://exchange.xforce.ibmcloud.com/vulnerabilities/15115 http://www.scan-associates.net/papers/phpnuke69.txt	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2003-1400`	vulnerable	2026-06-08 04:47:47.495802	Details available Cross-site scripting (XSS) vulnerability in the Your_Account module for PHP-Nuke 5.0 through 6.0 allows remote attackers to inject arbitrary web script or HTML via the user_avatar parameter. Published: 2007-10-19T10:00:00.000Z Updated: 2024-08-08T02:28:02.893Z Open on db.gcve.eu Reference links http://www.securityfocus.com/archive/1/309959 http://www.securityfocus.com/archive/1/310115 http://www.securityfocus.com/bid/6750 https://exchange.xforce.ibmcloud.com/vulnerabilities/11229	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.