HighCVSS 7.5
Incorrect access control in NexusPHP 1.5.beta5.20120707 allows unauthorized attackers to access published content.
Vendor
nexusphp vulnerabilities
10 published CVES affecting nexusphp, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
- Total
- 10
- Critical
- 7
- High
- 1
- Medium
- 2
- Low
- 0
- Unscored
- 0
- CISA KEV
- 0
Products
Latest nexusphp CVEs
Newest publication first
-
-
CriticalCVSS 9.8
SQL injection vulnerability in modrules.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the id parameter.
-
CriticalCVSS 9.8
SQL injection vulnerability in takeconfirm.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the classes parameter.
-
CriticalCVSS 9.8
SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the id parameter to linksmanage.php in an editlink action.
-
MediumCVSS 6.1
Cross Site Scripting (XSS) exists in NexusPHP 1.5.beta5.20120707 via the PATH_INFO to ipsearch.php, related to PHP_SELF.
-
CriticalCVSS 9.8
SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the usernw array parameter to nowarn.php.
-
CriticalCVSS 9.8
SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the setanswered parameter to staffbox.php.
-
CriticalCVSS 9.8
SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the delcheater parameter to cheaterbox.php.
-
CriticalCVSS 9.8
NexusPHP 1.5.beta5.20120707 has SQL Injection in forummanage.php via the sort parameter in an addforum action.
-
MediumCVSS 6.1
NexusPHP V1.5 has XSS via a javascript: or data: URL in a UBBCode url tag.
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.