Vulnerabilities

TI-2017-11218 CVE-2017-15305 · GHSA-c7fh-pcxq-pr84

XSS exists in NexusPHP 1.5 via the keyword parameter to messages.php.

LOW 29

XSS exists in NexusPHP 1.5 via the keyword parameter to messages.php.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00892 Published 2017-10-15 No fix listed CWE-79

TI-2017-09474 CVE-2017-12792 · GHSA-wx3p-jg9w-g5x7

Multiple cross-site request forgery (CSRF) vulnerabilities in NexusPHP 1.5 allow remote…

LOW 30

Multiple cross-site request forgery (CSRF) vulnerabilities in NexusPHP 1.5 allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) li…

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01212 Published 2017-10-02 No fix listed CWE-79

TI-2017-10636 CVE-2017-14534 · GHSA-mg67-7xr7-88cj

Cross Site Scripting (XSS) exists in NexusPHP 1.5.beta5.20120707 via the PATH_INFO to location.php, related to PHP_SELF.

LOW 28

Cross Site Scripting (XSS) exists in NexusPHP 1.5.beta5.20120707 via the PATH_INFO to location.php, related to PHP_SELF.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00669 Published 2017-09-18 No fix listed CWE-79

TI-2017-10614 CVE-2017-14512 · GHSA-qwf8-rhj3-8896

NexusPHP 1.5.beta5.20120707 has SQL Injection in forummanage.php via the sort parameter…

MEDIUM 44

NexusPHP 1.5.beta5.20120707 has SQL Injection in forummanage.php via the sort parameter in an editforum action, a different vulnerability than CVE-2017-12981.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01097 Published 2017-09-17 No fix listed CWE-89

TI-2017-10464 CVE-2017-14347 · GHSA-fr37-rgj4-cmfh

NexusPHP 1.5.beta5.20120707 has XSS in the returnto parameter to fun.php in a delete action.

LOW 28

NexusPHP 1.5.beta5.20120707 has XSS in the returnto parameter to fun.php in a delete action.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00683 Published 2017-09-12 No fix listed CWE-79

TI-2017-09559 CVE-2017-12906 · GHSA-7665-39qh-j8m6

Multiple cross-site scripting (XSS) vulnerabilities in NexusPHP allow remote attackers to…

LOW 29

Multiple cross-site scripting (XSS) vulnerabilities in NexusPHP allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) cheaters.php or (2) confirm_resend.php.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00818 Published 2017-09-07 No fix listed CWE-79

TI-2017-09506 CVE-2017-12838 · GHSA-2v3j-p6jh-fc8g

Cross-site request forgery (CSRF) vulnerability in NexusPHP 1.5 allows remote attackers…

LOW 39

Cross-site request forgery (CSRF) vulnerability in NexusPHP 1.5 allows remote attackers to hijack the authentication of users for requests that (1) send manas via a request to mybonus.php or (2) add administrators via un…

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.0056 Published 2017-09-07 No fix listed CWE-352

TI-2017-09458 CVE-2017-12776 · GHSA-3wf2-8r42-5jxv

SQL injection vulnerability in reports.php in NexusPHP 1.5 allows remote attackers to…

MEDIUM 45

SQL injection vulnerability in reports.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the delreport parameter.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01428 Published 2017-08-18 No fix listed CWE-89

TI-2017-09399 CVE-2017-12680 · GHSA-57ph-55m2-798w

Cross-Site Scripting (XSS) exists in NexusPHP 1.5 via the type parameter to shoutbox.php.

LOW 28

Cross-Site Scripting (XSS) exists in NexusPHP 1.5 via the type parameter to shoutbox.php.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00678 Published 2017-08-18 No fix listed CWE-79

TI-2017-09563 CVE-2017-12910 · GHSA-jqmc-9xvm-35mh

SQL injection vulnerability in massmail.php in NexusPHP 1.5 allows remote attackers to…

MEDIUM 45

SQL injection vulnerability in massmail.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the or parameter.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01336 Published 2017-08-17 No fix listed CWE-89

TI-2017-09562 CVE-2017-12909 · GHSA-phx8-gf7f-9rqw

SQL injection vulnerability in modtask.php in NexusPHP 1.5 allows remote attackers to…

MEDIUM 45

SQL injection vulnerability in modtask.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the userid parameter.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01364 Published 2017-08-17 No fix listed CWE-89

TI-2017-09561 CVE-2017-12908 · GHSA-qpgx-58jc-jwvw

SQL injection vulnerability in takeconfirm.php in NexusPHP 1.5 allows remote attackers to…

MEDIUM 45

SQL injection vulnerability in takeconfirm.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the conusr parameter.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01288 Published 2017-08-17 No fix listed CWE-89

TI-2017-09560 CVE-2017-12907 · GHSA-3fm3-mfvv-cwx4

Cross-Site Scripting (XSS) exists in NexusPHP version v1.5 via the url path to usersearch.php.

LOW 28

Cross-Site Scripting (XSS) exists in NexusPHP version v1.5 via the url path to usersearch.php.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00669 Published 2017-08-17 No fix listed CWE-79

TI-2017-09479 CVE-2017-12798 · GHSA-2h7r-8m29-9xgp

Cross-Site Scripting (XSS) exists in NexusPHP version v1.5 via the q parameter to searchsuggest.php.

LOW 28

Cross-Site Scripting (XSS) exists in NexusPHP version v1.5 via the q parameter to searchsuggest.php.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00669 Published 2017-08-10 No fix listed CWE-79

TI-2017-09459 CVE-2017-12777 · GHSA-w2fm-3qrh-358w

Cross-Site Scripting (XSS) exists in NexusPHP version v1.5 via some parameter to usersearch.php.

LOW 28

Cross-Site Scripting (XSS) exists in NexusPHP version v1.5 via some parameter to usersearch.php.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00639 Published 2017-08-09 No fix listed CWE-79

TI-2017-09380 CVE-2017-12655 · GHSA-96q8-fm8v-v4c6

Cross-Site Scripting (XSS) exists in NexusPHP version v1.5 via the query parameter to log.php in a dailylog action.

LOW 28

Cross-Site Scripting (XSS) exists in NexusPHP version v1.5 via the query parameter to log.php in a dailylog action.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00669 Published 2017-08-07 No fix listed CWE-79

Vulnerabilities

Filters