vulnwire
4.3med

CVE-2004-22931 exploit

Multiple cross-site scripting (XSS) vulnerabilities in PHP-Nuke 6.0 to 7.3 allow remote attackers to inject arbitrary web script or HTML vi…

Published 21 y ago · modified 4 mo ago · JSON

CVSS
4.3
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
2.0%
percentile 81%
Public exploits
1
Exploit-DB

Multiple cross-site scripting (XSS) vulnerabilities in PHP-Nuke 6.0 to 7.3 allow remote attackers to inject arbitrary web script or HTML via the (1) eid parameter or (2) query parameter to the Encyclopedia module, (3) preview_review function in the Reviews module as demonstrated by the url, cover, rlanguage, and hits parameters, or (4) savecomment function in the Reviews module, as demonstrated using the uname parameter. NOTE: the Faq/categories and Encyclopedia/ltr issues are already covered by CVE-2005-1023.

Exploit prediction (EPSS)

1.97% probability of exploitation in the next 30 days, higher than 81% of all scored CVEs.

Exploits and detections

  • EDB-24191 PHP-Nuke 6.x/7.x Encyclopedia Module - Multiple Function Cross-Site Scripting Vulnerabilities · webapps · 2004-06-11

CVSS scores

Assigned byVersionScoreVector
NVD2.04.3AV:N/AC:M/Au:N/C:N/I:P/A:N

References

  • exchange.xforce.ibmcloud.com /vulnerabilities/16406 · vdb-entry, x_refsource_XF, x_transferred
  • osvdb.org /6999 · vdb-entry, x_refsource_OSVDB, x_transferred
  • osvdb.org /6997 · vdb-entry, x_refsource_OSVDB, x_transferred
  • secunia.com /advisories/11852 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • securityfocus.com /archive/1/365865 · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • securityfocus.com /bid/10524 · vdb-entry, x_refsource_BID, x_transferred
  • osvdb.org /6998 · vdb-entry, x_refsource_OSVDB, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.