Vendors / Nexusphp Records 14 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 8
CVSS high 1
Exploited now Nexusphp records in CISA KEV No Nexusphp vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority HIGH 67
Multiple SQL injection vulnerabilities in NexusPHP before 1.7.33 allow remote attackers to execute arbitrary SQL commands via the conuser[] parameter in takeconfirm.php; the delcheater parameter in cheaterbox.php; or the…
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.19374 · Published 2023-01-19 · No fix listed CWE-89
Priority MEDIUM 59
A persistent cross-site scripting (XSS) vulnerability in NexusPHP before 1.7.33 allows remote authenticated attackers to permanently inject arbitrary web script or HTML via the title parameter used in /subtitles.php.
CVSS 3.1 MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.60115 · Published 2023-01-19 · No fix listed CWE-79
Priority MEDIUM 47
SQL injection vulnerability in modrules.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02429 · Published 2022-03-30 · No fix listed CWE-89
Priority MEDIUM 46
SQL injection vulnerability in takeconfirm.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the classes parameter.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01979 · Published 2022-03-30 · No fix listed CWE-89
Priority MEDIUM 45
SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the setanswered parameter to staffbox.php.
CVSS 3.0 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01497 · Published 2017-08-24 · No fix listed CWE-89
Priority MEDIUM 45
SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the delcheater parameter to cheaterbox.php.
CVSS 3.0 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01497 · Published 2017-08-24 · No fix listed CWE-89
Priority MEDIUM 44
SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the id parameter to linksmanage.php in an editlink action.
CVSS 3.0 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01137 · Published 2017-08-31 · No fix listed CWE-89
Priority MEDIUM 44
SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the usernw array parameter to nowarn.php.
CVSS 3.0 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01191 · Published 2017-08-31 · No fix listed CWE-89
Priority MEDIUM 44
NexusPHP 1.5.beta5.20120707 has SQL Injection in forummanage.php via the sort parameter in an addforum action.
CVSS 3.0 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01161 · Published 2017-08-21 · No fix listed CWE-89
Priority LOW 37
Incorrect access control in NexusPHP 1.5.beta5.20120707 allows unauthorized attackers to access published content.
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.02046 · Published 2022-03-30 · No fix listed CWE-863
Priority LOW 30
Multiple reflective cross-site scripting (XSS) vulnerabilities in NexusPHP before 1.7.33 allow remote attackers to inject arbitrary web script or HTML via the secret parameter in /login.php; q parameter in /user-ban-log.…
CVSS 3.1 MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.01587 · Published 2023-01-19 · No fix listed CWE-79
Priority LOW 28
Cross Site Scripting (XSS) exists in NexusPHP 1.5.beta5.20120707 via the PATH_INFO to ipsearch.php, related to PHP_SELF.
CVSS 3.0 MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00649 · Published 2017-08-31 · No fix listed CWE-79
Priority LOW 28
NexusPHP V1.5 has XSS via a javascript: or data: URL in a UBBCode url tag.
CVSS 3.1 MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00671 · Published 2017-07-26 · No fix listed CWE-79
Priority LOW 21
Weak access control in NexusPHP before 1.7.33 allows a remote authenticated user to edit any post in the forum (this is caused by a lack of checks performed by the /forums.php?action=post page).
CVSS 3.1 MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00653 · Published 2023-01-19 · No fix listed CWE-284
Open these records in search → All records by CVSS severity
8 1 5 0 0
THREATIST.IORead the docs