Vulnerabilities

TI-2022-23233 CVE-2022-46890 · GHSA-xpvg-vmj8-f29g

Weak access control in NexusPHP before 1.7.33 allows a remote authenticated user to edit…

LOW 21

Weak access control in NexusPHP before 1.7.33 allows a remote authenticated user to edit any post in the forum (this is caused by a lack of checks performed by the /forums.php?action=post page).

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00653 Published 2023-01-19 No fix listed CWE-284

TI-2022-23232 CVE-2022-46889 · GHSA-c89f-g4w2-93vv

A persistent cross-site scripting (XSS) vulnerability in NexusPHP before 1.7.33 allows…

MEDIUM 59

A persistent cross-site scripting (XSS) vulnerability in NexusPHP before 1.7.33 allows remote authenticated attackers to permanently inject arbitrary web script or HTML via the title parameter used in /subtitles.php.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.60115 Published 2023-01-19 No fix listed CWE-79

TI-2022-23231 CVE-2022-46888 · GHSA-q6f5-wp68-4qvq

Multiple reflective cross-site scripting (XSS) vulnerabilities in NexusPHP before 1.7.33…

LOW 30

Multiple reflective cross-site scripting (XSS) vulnerabilities in NexusPHP before 1.7.33 allow remote attackers to inject arbitrary web script or HTML via the secret parameter in /login.php; q parameter in /user-ban-log.…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01587 Published 2023-01-19 No fix listed CWE-79

TI-2022-23230 CVE-2022-46887 · GHSA-g8hg-35m6-52vg

Multiple SQL injection vulnerabilities in NexusPHP before 1.7.33 allow remote attackers…

HIGH 67

Multiple SQL injection vulnerabilities in NexusPHP before 1.7.33 allow remote attackers to execute arbitrary SQL commands via the conuser[] parameter in takeconfirm.php; the delcheater parameter in cheaterbox.php; or the…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.19374 Published 2023-01-19 No fix listed CWE-89

TI-2020-15190 CVE-2020-24769 · GHSA-pcj2-6pf9-jxrr

SQL injection vulnerability in takeconfirm.php in NexusPHP 1.5 allows remote attackers to…

MEDIUM 46

SQL injection vulnerability in takeconfirm.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the classes parameter.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01979 Published 2022-03-30 No fix listed CWE-89

TI-2020-15191 CVE-2020-24770 · GHSA-wv7r-w684-37ff

SQL injection vulnerability in modrules.php in NexusPHP 1.5 allows remote attackers to…

MEDIUM 47

SQL injection vulnerability in modrules.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the id parameter.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02429 Published 2022-03-30 No fix listed CWE-89

TI-2020-15192 CVE-2020-24771 · GHSA-2hx6-24cf-h2h4

Incorrect access control in NexusPHP 1.5.beta5.20120707 allows unauthorized attackers to access published content.

LOW 37

Incorrect access control in NexusPHP 1.5.beta5.20120707 allows unauthorized attackers to access published content.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02046 Published 2022-03-30 No fix listed CWE-863

TI-2017-10244 CVE-2017-14076 · GHSA-j9j2-f8h5-4hv8

SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the id parameter to linksmanage.php in an editlink action.

MEDIUM 44

SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the id parameter to linksmanage.php in an editlink action.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01137 Published 2017-08-31 No fix listed CWE-89

TI-2017-10242 CVE-2017-14070 · GHSA-7c4x-mwhc-mq7q

Cross Site Scripting (XSS) exists in NexusPHP 1.5.beta5.20120707 via the PATH_INFO to ipsearch.php, related to PHP_SELF.

LOW 28

Cross Site Scripting (XSS) exists in NexusPHP 1.5.beta5.20120707 via the PATH_INFO to ipsearch.php, related to PHP_SELF.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00649 Published 2017-08-31 No fix listed CWE-79

TI-2017-10241 CVE-2017-14069 · GHSA-mmp5-44x6-2cpv

SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the usernw array parameter to nowarn.php.

MEDIUM 44

SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the usernw array parameter to nowarn.php.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01191 Published 2017-08-31 No fix listed CWE-89

TI-2017-09947 CVE-2017-13669 · GHSA-g42m-grhr-jgj3

SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the setanswered parameter to staffbox.php.

MEDIUM 45

SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the setanswered parameter to staffbox.php.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01497 Published 2017-08-24 No fix listed CWE-89

TI-2017-09398 CVE-2017-12679 · GHSA-5gf7-54mg-pxxr

SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the delcheater parameter to cheaterbox.php.

MEDIUM 45

SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the delcheater parameter to cheaterbox.php.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01497 Published 2017-08-24 No fix listed CWE-89

TI-2017-09624 CVE-2017-12981 · GHSA-f2vg-j7cg-mp3f

NexusPHP 1.5.beta5.20120707 has SQL Injection in forummanage.php via the sort parameter in an addforum action.

MEDIUM 44

NexusPHP 1.5.beta5.20120707 has SQL Injection in forummanage.php via the sort parameter in an addforum action.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01161 Published 2017-08-21 No fix listed CWE-89

TI-2017-08626 CVE-2017-11651 · GHSA-8jh4-rrj5-8rvx

NexusPHP V1.5 has XSS via a javascript: or data: URL in a UBBCode url tag.

LOW 28

NexusPHP V1.5 has XSS via a javascript: or data: URL in a UBBCode url tag.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00671 Published 2017-07-26 No fix listed CWE-79

Vulnerabilities

Filters