Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2004-2020

Multiple cross-site scripting (XSS) vulnerabilities in Php-Nuke 6.x through 7.3 allow remote attackers to inject arbitrary HTML or web script into the (1) optionbox parameter in the News module, (2) date parameter in the Statistics module, (3) year, month, and month_1 parameters in the Stories_Archive module, (4) mode, order, and thold parameters in the Surveys module, or (5) a SQL statement to index.php, as processed by mainfile.php.

Published

2004-12-31T05:00:00.000

Last Modified

2025-04-03T01:03:51.193

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 4.3 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

  • Access Vector: NETWORK
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: NONE
  • Integrity Impact: PARTIAL
  • Availability Impact: NONE
Exploitability Score

8.6

Impact Score

2.9

Weaknesses
  • Type: Primary
    NVD-CWE-Other
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application francisco_burzi php-nuke 6.0 Yes
Application francisco_burzi php-nuke 6.5 Yes
Application francisco_burzi php-nuke 6.5_beta1 Yes
Application francisco_burzi php-nuke 6.5_final Yes
Application francisco_burzi php-nuke 6.5_rc1 Yes
Application francisco_burzi php-nuke 6.5_rc2 Yes
Application francisco_burzi php-nuke 6.5_rc3 Yes
Application francisco_burzi php-nuke 6.6 Yes
Application francisco_burzi php-nuke 6.7 Yes
Application francisco_burzi php-nuke 6.9 Yes
Application francisco_burzi php-nuke 7.0 Yes
Application francisco_burzi php-nuke 7.0_final Yes
Application francisco_burzi php-nuke 7.1 Yes
Application francisco_burzi php-nuke 7.2 Yes
Application francisco_burzi php-nuke 7.3 Yes
References