Nexusphp
Nexusphp: vulnerabilidades y CVE
Nexusphp tiene 14 vulnerabilidades publicadas, 0 de ellas en los últimos 12 meses. 8 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE14
Últimos 12 meses0
Críticas8
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2022-46890 | Media (4.3) | 0.64% | — | 19 ene 2023 | Weak access control in NexusPHP before 1.7.33 allows a remote authenticated user to edit any post in the forum (this is caused by a lack of checks performed by the /forums.php?action=post page). |
| CVE-2022-46889 | Media (5.4) | 60% | — | 19 ene 2023 | A persistent cross-site scripting (XSS) vulnerability in NexusPHP before 1.7.33 allows remote authenticated attackers to permanently inject arbitrary web script or HTML via the title parameter used in /subtitles.php. |
| CVE-2022-46888 | Media (6.1) | 1.5% | — | 19 ene 2023 | Multiple reflective cross-site scripting (XSS) vulnerabilities in NexusPHP before 1.7.33 allow remote attackers to inject arbitrary web script or HTML via the secret parameter in /login.php; q parameter in… |
| CVE-2022-46887 | Crítica (9.8) | 19% | — | 19 ene 2023 | Multiple SQL injection vulnerabilities in NexusPHP before 1.7.33 allow remote attackers to execute arbitrary SQL commands via the conuser[] parameter in takeconfirm.php; the delcheater parameter in cheaterbox.php; or… |
| CVE-2020-24771 | Alta (7.5) | 2.0% | — | 30 mar 2022 | Incorrect access control in NexusPHP 1.5.beta5.20120707 allows unauthorized attackers to access published content. |
| CVE-2020-24770 | Crítica (9.8) | 2.4% | — | 30 mar 2022 | SQL injection vulnerability in modrules.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the id parameter. |
| CVE-2020-24769 | Crítica (9.8) | 2.0% | — | 30 mar 2022 | SQL injection vulnerability in takeconfirm.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the classes parameter. |
| CVE-2017-14076 | Crítica (9.8) | 1.1% | — | 31 ago 2017 | SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the id parameter to linksmanage.php in an editlink action. |
| CVE-2017-14070 | Media (6.1) | 0.65% | — | 31 ago 2017 | Cross Site Scripting (XSS) exists in NexusPHP 1.5.beta5.20120707 via the PATH_INFO to ipsearch.php, related to PHP_SELF. |
| CVE-2017-14069 | Crítica (9.8) | 1.2% | — | 31 ago 2017 | SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the usernw array parameter to nowarn.php. |
| CVE-2017-13669 | Crítica (9.8) | 1.5% | — | 24 ago 2017 | SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the setanswered parameter to staffbox.php. |
| CVE-2017-12679 | Crítica (9.8) | 1.5% | — | 24 ago 2017 | SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the delcheater parameter to cheaterbox.php. |
| CVE-2017-12981 | Crítica (9.8) | 1.2% | — | 21 ago 2017 | NexusPHP 1.5.beta5.20120707 has SQL Injection in forummanage.php via the sort parameter in an addforum action. |
| CVE-2017-11651 | Media (6.1) | 0.67% | — | 26 jul 2017 | NexusPHP V1.5 has XSS via a javascript: or data: URL in a UBBCode url tag. |