Vulnerabilidades
Resumen — últimos 7 días
Vulnerabilidades nuevas2744▼ 71 respecto a la semana anterior
Críticas / altas1416▲ 184 respecto a la semana anterior
Nueva explotación activa (KEV)5▼ 5 respecto a la semana anterior
Sin puntuar (sin CVSS)106▼ 394 respecto a la semana anterior
31 resultados, ordenados por fecha de publicación (más recientes primero)
| CVE | Estado | Severidad | EPSS | Explotación activa | Tecnologías afectadas | Publicada ▼ | Modificada | Descripción |
|---|---|---|---|---|---|---|---|---|
| Modificada | Media (4.3) | 0.64% | — | Nexusphp | 19/1/2023 | 17/6/2026 | Weak access control in NexusPHP before 1.7.33 allows a remote authenticated user to edit any post in the forum (this is caused by a lack of checks performed by the /forums.php?action=post page). | |
| Modificada | Media (5.4) | 60% | — | Nexusphp | 19/1/2023 | 17/6/2026 | A persistent cross-site scripting (XSS) vulnerability in NexusPHP before 1.7.33 allows remote authenticated attackers to permanently inject arbitrary web script or HTML via the title parameter used in /subtitles.php. | |
| Modificada | Media (6.1) | 1.5% | — | Nexusphp | 19/1/2023 | 17/6/2026 | Multiple reflective cross-site scripting (XSS) vulnerabilities in NexusPHP before 1.7.33 allow remote attackers to inject arbitrary web script or HTML via the secret parameter in /login.php; q parameter in /user-ban-log.php; query parameter in /log.php; text parameter in /moresmiles.php; q parameter in myhr.php; or id… | |
| Modificada | Crítica (9.8) | 19% | — | Nexusphp | 19/1/2023 | 17/6/2026 | Multiple SQL injection vulnerabilities in NexusPHP before 1.7.33 allow remote attackers to execute arbitrary SQL commands via the conuser[] parameter in takeconfirm.php; the delcheater parameter in cheaterbox.php; or the usernw parameter in nowarn.php. | |
| Modificada | Alta (7.5) | 2.0% | — | Nexusphp | 30/3/2022 | 17/6/2026 | Incorrect access control in NexusPHP 1.5.beta5.20120707 allows unauthorized attackers to access published content. | |
| Modificada | Crítica (9.8) | 2.4% | — | Nexusphp | 30/3/2022 | 17/6/2026 | SQL injection vulnerability in modrules.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the id parameter. | |
| Modificada | Crítica (9.8) | 2.0% | — | Nexusphp | 30/3/2022 | 17/6/2026 | SQL injection vulnerability in takeconfirm.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the classes parameter. | |
| Modificada | Media (6.1) | 0.89% | — | Nexusphp Project Nexusphp | 15/10/2017 | 17/6/2026 | XSS exists in NexusPHP 1.5 via the keyword parameter to messages.php. | |
| Modificada | Media (6.1) | 1.2% | — | Nexusphp Project Nexusphp | 3/10/2017 | 17/6/2026 | Multiple cross-site request forgery (CSRF) vulnerabilities in NexusPHP 1.5 allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) linkname, (2) url, or (3) title parameter in an add action to linksmanage.php. | |
| Modificada | Media (6.1) | 0.67% | — | Nexusphp Project Nexusphp | 18/9/2017 | 17/6/2026 | Cross Site Scripting (XSS) exists in NexusPHP 1.5.beta5.20120707 via the PATH_INFO to location.php, related to PHP_SELF. | |
| Modificada | Crítica (9.8) | 1.1% | — | Nexusphp Project Nexusphp | 17/9/2017 | 17/6/2026 | NexusPHP 1.5.beta5.20120707 has SQL Injection in forummanage.php via the sort parameter in an editforum action, a different vulnerability than CVE-2017-12981. | |
| Modificada | Media (6.1) | 0.68% | — | Nexusphp Project Nexusphp | 12/9/2017 | 17/6/2026 | NexusPHP 1.5.beta5.20120707 has XSS in the returnto parameter to fun.php in a delete action. | |
| Modificada | Media (6.1) | 0.82% | — | Nexusphp Project Nexusphp | 7/9/2017 | 17/6/2026 | Multiple cross-site scripting (XSS) vulnerabilities in NexusPHP allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) cheaters.php or (2) confirm_resend.php. | |
| Modificada | Alta (8.8) | 0.56% | — | Nexusphp Project Nexusphp | 7/9/2017 | 17/6/2026 | Cross-site request forgery (CSRF) vulnerability in NexusPHP 1.5 allows remote attackers to hijack the authentication of users for requests that (1) send manas via a request to mybonus.php or (2) add administrators via unspecified vectors. | |
| Modificada | Crítica (9.8) | 1.1% | — | Nexusphp | 31/8/2017 | 17/6/2026 | SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the id parameter to linksmanage.php in an editlink action. | |
| Modificada | Media (6.1) | 0.65% | — | Nexusphp | 31/8/2017 | 17/6/2026 | Cross Site Scripting (XSS) exists in NexusPHP 1.5.beta5.20120707 via the PATH_INFO to ipsearch.php, related to PHP_SELF. | |
| Modificada | Crítica (9.8) | 1.2% | — | Nexusphp | 31/8/2017 | 17/6/2026 | SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the usernw array parameter to nowarn.php. | |
| Modificada | Crítica (9.8) | 1.5% | — | Nexusphp | 24/8/2017 | 17/6/2026 | SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the setanswered parameter to staffbox.php. | |
| Modificada | Crítica (9.8) | 1.5% | — | Nexusphp | 24/8/2017 | 17/6/2026 | SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the delcheater parameter to cheaterbox.php. | |
| Modificada | Crítica (9.8) | 1.2% | — | Nexusphp | 21/8/2017 | 17/6/2026 | NexusPHP 1.5.beta5.20120707 has SQL Injection in forummanage.php via the sort parameter in an addforum action. | |
| Modificada | Crítica (9.8) | 1.4% | — | Nexusphp Project Nexusphp | 18/8/2017 | 17/6/2026 | SQL injection vulnerability in reports.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the delreport parameter. | |
| Modificada | Media (6.1) | 0.68% | — | Nexusphp Project Nexusphp | 18/8/2017 | 17/6/2026 | Cross-Site Scripting (XSS) exists in NexusPHP 1.5 via the type parameter to shoutbox.php. | |
| Modificada | Crítica (9.8) | 1.3% | — | Nexusphp Project Nexusphp | 17/8/2017 | 17/6/2026 | SQL injection vulnerability in massmail.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the or parameter. | |
| Modificada | Crítica (9.8) | 1.4% | — | Nexusphp Project Nexusphp | 17/8/2017 | 17/6/2026 | SQL injection vulnerability in modtask.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the userid parameter. | |
| Modificada | Crítica (9.8) | 1.3% | — | Nexusphp Project Nexusphp | 17/8/2017 | 17/6/2026 | SQL injection vulnerability in takeconfirm.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the conusr parameter. |