Vulnerabilities

TI-2020-14058 CVE-2020-21474 · GHSA-2jpx-j4q3-c28w

File Upload vulnerability in NucleusCMS v.3.71 allows a remote attacker to execute…

MEDIUM 51

File Upload vulnerability in NucleusCMS v.3.71 allows a remote attacker to execute arbitrary code via the /nucleus/plugins/skinfiles/?dir=rsd parameter.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01169 Published 2023-06-20 No fix listed CWE-434

TI-2021-15628 CVE-2021-37770 · GHSA-5xq9-crf7-769q

Nucleus CMS v3.71 is affected by a file upload vulnerability.

LOW 34

Nucleus CMS v3.71 is affected by a file upload vulnerability.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01332 Published 2022-06-30 No fix listed CWE-434

TI-2018-11923 CVE-2018-16636 · GHSA-6w76-xxgp-fhm5

Nucleus CMS 3.70 allows HTML Injection via the index.php body parameter.

LOW 31

Nucleus CMS 3.70 allows HTML Injection via the index.php body parameter.

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01016 Published 2018-12-10 No fix listed CWE-79

TI-2015-04588 CVE-2015-5454 · GHSA-wwgg-wchm-xqp9

Cross-site scripting (XSS) vulnerability in Nucleus CMS allows remote attackers to inject…

LOW 23

Cross-site scripting (XSS) vulnerability in Nucleus CMS allows remote attackers to inject arbitrary web script or HTML via the title parameter when adding a new item.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01604 Published 2015-07-08 No fix listed CWE-79

TI-2011-03317 CVE-2011-3760 · GHSA-2r6w-9948-hmjf

Nucleus 3.61 allows remote attackers to obtain sensitive information via a direct request…

LOW 26

Nucleus 3.61 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by xmlrpc/api_nucleus.inc.php and certain…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.0135 Published 2011-09-24 No fix listed CWE-200

Vulnerabilities

Filters

File Upload vulnerability in NucleusCMS v.3.71 allows a remote attacker to execute…

Nucleus CMS v3.71 is affected by a file upload vulnerability.

Nucleus CMS 3.70 allows HTML Injection via the index.php body parameter.

Cross-site scripting (XSS) vulnerability in Nucleus CMS allows remote attackers to inject…

Nucleus 3.61 allows remote attackers to obtain sensitive information via a direct request…