Nexusphp

nexusphp

14 CVEs • 1 product

Products (1)

Click to collapse

Toggle

CVEs (14)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2022-46890 1Nexusphp 1Nexusphp Apr 3, 2025 Jan 19, 2023 N/A· v4 4.3 MEDIUM· v3 N/A· v2 Weak access control in NexusPHP before 1.7.33 allows a remote authenticated user to edit any post in the forum (this is caused by a lack of checks performed by the /forums.php?action=post page).
CVE-2022-46889 1Nexusphp 1Nexusphp Apr 3, 2025 Jan 19, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 A persistent cross-site scripting (XSS) vulnerability in NexusPHP before 1.7.33 allows remote authenticated attackers to permanently inject arbitrary web script or HTML via the title parameter used in /subtitles.php.
CVE-2022-46888 1Nexusphp 1Nexusphp Apr 3, 2025 Jan 19, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Multiple reflective cross-site scripting (XSS) vulnerabilities in NexusPHP before 1.7.33 allow remote attackers to inject arbitrary web script or HTML via the secret parameter in /login.php; q parameter in /user-ban-log....Show more Multiple reflective cross-site scripting (XSS) vulnerabilities in NexusPHP before 1.7.33 allow remote attackers to inject arbitrary web script or HTML via the secret parameter in /login.php; q parameter in /user-ban-log.php; query parameter in /log.php; text parameter in /moresmiles.php; q parameter in myhr.php; or id parameter in /viewrequests.php.Show less
CVE-2022-46887 1Nexusphp 1Nexusphp Apr 3, 2025 Jan 19, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Multiple SQL injection vulnerabilities in NexusPHP before 1.7.33 allow remote attackers to execute arbitrary SQL commands via the conuser[] parameter in takeconfirm.php; the delcheater parameter in cheaterbox.php; or the...Show more Multiple SQL injection vulnerabilities in NexusPHP before 1.7.33 allow remote attackers to execute arbitrary SQL commands via the conuser[] parameter in takeconfirm.php; the delcheater parameter in cheaterbox.php; or the usernw parameter in nowarn.php.Show less
CVE-2020-24771 1Nexusphp 1Nexusphp Nov 21, 2024 Mar 30, 2022 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Incorrect access control in NexusPHP 1.5.beta5.20120707 allows unauthorized attackers to access published content.
CVE-2020-24770 1Nexusphp 1Nexusphp Nov 21, 2024 Mar 30, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 SQL injection vulnerability in modrules.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2020-24769 1Nexusphp 1Nexusphp Nov 21, 2024 Mar 30, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 SQL injection vulnerability in takeconfirm.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the classes parameter.
CVE-2017-14076 1Nexusphp 1Nexusphp May 13, 2026 Aug 31, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the id parameter to linksmanage.php in an editlink action.
CVE-2017-14070 1Nexusphp 1Nexusphp May 13, 2026 Aug 31, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross Site Scripting (XSS) exists in NexusPHP 1.5.beta5.20120707 via the PATH_INFO to ipsearch.php, related to PHP_SELF.
CVE-2017-14069 1Nexusphp 1Nexusphp May 13, 2026 Aug 31, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the usernw array parameter to nowarn.php.
CVE-2017-13669 1Nexusphp 1Nexusphp May 13, 2026 Aug 24, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the setanswered parameter to staffbox.php.
CVE-2017-12679 1Nexusphp 1Nexusphp May 13, 2026 Aug 24, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the delcheater parameter to cheaterbox.php.
CVE-2017-12981 1Nexusphp 1Nexusphp May 13, 2026 Aug 21, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 NexusPHP 1.5.beta5.20120707 has SQL Injection in forummanage.php via the sort parameter in an addforum action.
CVE-2017-11651 1Nexusphp 1Nexusphp May 13, 2026 Jul 26, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 NexusPHP V1.5 has XSS via a javascript: or data: URL in a UBBCode url tag.