TI-2025-08024 CVE-2025-8772 · GHSA-xg73-5hqj-7hwg
Vinades NukeViet Module index.php server-side request forgery
Priority MEDIUM 57
A vulnerability, which was classified as problematic, has been found in Vinades NukeViet up to 4.5.06.
Vulnerabilities
13 records
TI-2024-24300 CVE-2024-36531 · GHSA-grwc-qr6v-mgmv
nukeviet v.4.5 and before and nukeviet-egov v.1.2.02 and before are vulnerable to…
Priority MEDIUM 61
nukeviet v.4.5 and before and nukeviet-egov v.1.2.02 and before are vulnerable to arbitrary code execution via the /admin/extensions/upload.php component.
TI-2024-24299 CVE-2024-36528 · GHSA-mhj4-vrcv-x4xc
nukeviet v.4.5 and before and nukeviet-egov v.1.2.02 and before have a Deserialization…
Priority HIGH 73
nukeviet v.4.5 and before and nukeviet-egov v.1.2.02 and before have a Deserialization vulnerability which results in code execution via /admin/extensions/download.php and /admin/extensions/upload.php.
TI-2022-03644 CVE-2022-3975 · GHSA-x45f-j34v-75xm
NukeViet CMS Data URL Request.php filterAttr cross site scripting
Priority LOW 28
A vulnerability, which was classified as problematic, has been found in NukeViet CMS.
TI-2022-12964 CVE-2022-30874 · GHSA-pm37-5j5m-6cvw
There is a Cross Site Scripting Stored (XSS) vulnerability in NukeViet CMS before 4.5.02.
Priority LOW 26
There is a Cross Site Scripting Stored (XSS) vulnerability in NukeViet CMS before 4.5.02.
TI-2020-14169 CVE-2020-21809 · GHSA-m8jx-mxf9-2rpw
SQL Injection vulnerability in NukeViet CMS module Shops 4.0.29 and 4.3 via the (1)…
Priority MEDIUM 45
SQL Injection vulnerability in NukeViet CMS module Shops 4.0.29 and 4.3 via the (1) listid parameter in detail.php and the (2) group_price or groupid parameters in search_result.php.
TI-2020-14168 CVE-2020-21808 · GHSA-84gf-rw24-pfqg
SQL Injection vulnerability in NukeViet CMS 4.0.10 - 4.3.07 via:the topicsid parameter in…
Priority MEDIUM 45
SQL Injection vulnerability in NukeViet CMS 4.0.10 - 4.3.07 via:the topicsid parameter in modules/news/admin/addtotopics.php.
TI-2020-14391 CVE-2020-22765 · GHSA-6j4j-22qg-9ffm
Cross Site Scripting (XSS) vulnerability in NukeViet cms 4.4.0 via the editor in the News module.
Priority LOW 28
Cross Site Scripting (XSS) vulnerability in NukeViet cms 4.4.0 via the editor in the News module.
TI-2019-05441 CVE-2019-7726 · GHSA-q4qv-fmwc-qxpx
modules/banners/funcs/click.php in NukeViet before 4.3.04 has a SQL INSERT statement with…
Priority MEDIUM 46
modules/banners/funcs/click.php in NukeViet before 4.3.04 has a SQL INSERT statement with raw header data from an HTTP request (e.g., Referer and User-Agent).
TI-2019-05440 CVE-2019-7725 · GHSA-32wr-8wxm-852c
includes/core/is_user.php in NukeViet before 4.3.04 deserializes the untrusted…
Priority MEDIUM 47
includes/core/is_user.php in NukeViet before 4.3.04 deserializes the untrusted nvloginhash cookie (i.e., the code relies on PHP's serialization format when JSON can be used to eliminate the risk).
TI-2020-10337 CVE-2020-13155 · GHSA-7rw5-6pr4-fgh3
clearsystem.php in NukeViet 4.4 allows CSRF with resultant HTML injection via the deltype…
Priority LOW 39
clearsystem.php in NukeViet 4.4 allows CSRF with resultant HTML injection via the deltype parameter to the admin/index.php?nv=webtools&op=clearsystem URI.
TI-2020-10338 CVE-2020-13156 · GHSA-c2px-jcgw-9x57
modules\users\admin\add_user.php in NukeViet 4.4 allows CSRF to add a user account via…
Priority LOW 30
modules\users\admin\add_user.php in NukeViet 4.4 allows CSRF to add a user account via the admin/index.php?nv=users&op=user_add URI.
TI-2020-10339 CVE-2020-13157 · GHSA-g3xf-85wc-45gq
modules\users\admin\edit.php in NukeViet 4.4 allows CSRF to change a user's password via…
Priority LOW 30
modules\users\admin\edit.php in NukeViet 4.4 allows CSRF to change a user's password via an admin/index.php?nv=users&op=edit&userid= URI.