Filtered by vendor Postnuke Software Foundation
Subscriptions
Total
49 CVE
CVE | Vendors | Products | Updated | CVSS v3.1 |
---|---|---|---|---|
CVE-2006-5733 | 1 Postnuke Software Foundation | 1 Postnuke | 2025-04-09 | N/A |
Directory traversal vulnerability in error.php in PostNuke 0.763 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the PNSVlang (PNSV lang) cookie, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by error.php. | ||||
CVE-2006-5121 | 1 Postnuke Software Foundation | 1 Postnuke | 2025-04-09 | N/A |
SQL injection vulnerability in modules/Downloads/admin.php in the Admin section of PostNuke 0.762 allows remote attackers to execute arbitrary SQL commands via the hits parameter. | ||||
CVE-2007-3584 | 1 Postnuke Software Foundation | 1 Pnphpbb2 | 2025-04-09 | N/A |
SQL injection vulnerability in viewforum.php in PNphpBB2 1.2i and earlier for Postnuke allows remote attackers to execute arbitrary SQL commands via the order parameter. | ||||
CVE-2008-2191 | 1 Postnuke Software Foundation | 1 Pnencyclopedia | 2025-04-09 | N/A |
SQL injection vulnerability in the pnEncyclopedia module 0.2.0 and earlier for PostNuke allows remote attackers to execute arbitrary SQL commands via the id parameter in a display_term action to index.php. | ||||
CVE-2007-1158 | 1 Postnuke Software Foundation | 1 Pagesetter | 2025-04-09 | N/A |
Directory traversal vulnerability in index.php in the Pagesetter 6.2.0 through 6.3.0 beta 5 module for PostNuke allows remote attackers to read arbitrary files via a .. (dot dot) in the id parameter. | ||||
CVE-2007-0385 | 1 Postnuke Software Foundation | 1 Postnuke | 2025-04-09 | N/A |
The faq section in PostNuke 0.764 allows remote attackers to obtain sensitive information (the full path) via "unvalidated output" in FAQ/index.php, possibly involving an undefined id_cat variable. | ||||
CVE-2006-6233 | 1 Postnuke Software Foundation | 1 Postnuke | 2025-04-09 | N/A |
SQL injection vulnerability in the Downloads module for unknown versions of PostNuke allows remote attackers to execute arbitrary SQL commands via the lid parameter in a viewdownloaddetails operation. NOTE: this issue might have been in the viewdownloaddetails function in dl-downloaddetails.php, but PostNuke 0.764 does not appear to have this issue. | ||||
CVE-2007-2492 | 1 Postnuke Software Foundation | 1 Postnuke V4bjournal Module | 2025-04-09 | N/A |
SQL injection vulnerability in index.php in the v4bJournal module for PostNuke allows remote authenticated users to execute arbitrary SQL commands via the id parameter in a journal_comment action. | ||||
CVE-2007-0384 | 1 Postnuke Software Foundation | 1 Postnuke | 2025-04-09 | N/A |
Cross-site scripting (XSS) vulnerability in preview in the reviews section in PostNuke 0.764 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | ||||
CVE-2008-2012 | 1 Postnuke Software Foundation | 1 Postschedule | 2025-04-09 | N/A |
SQL injection vulnerability in index.php in the PostSchedule 1.0 module for PostNuke allows remote attackers to execute arbitrary SQL commands via the eid parameter in an event action. | ||||
CVE-2007-0386 | 1 Postnuke Software Foundation | 1 Postnuke | 2025-04-09 | N/A |
Unspecified vulnerability in the rating section in PostNuke 0.764 has unknown impact and attack vectors, related to "an interesting bug." | ||||
CVE-2007-3052 | 1 Postnuke Software Foundation | 1 Pnphpbb | 2025-04-09 | N/A |
SQL injection vulnerability in index.php in the PNphpBB2 1.2i and earlier module for PostNuke allows remote attackers to execute arbitrary SQL commands via the c parameter. | ||||
CVE-2006-6267 | 1 Postnuke Software Foundation | 1 Postnuke | 2025-04-09 | N/A |
PostNuke 0.7.5.0, and certain minor versions, allows remote attackers to obtain sensitive information via a non-numeric value of the stop parameter, which reveals the path in an error message. | ||||
CVE-2005-1695 | 1 Postnuke Software Foundation | 1 Postnuke | 2025-04-03 | N/A |
Multiple cross-site scripting (XSS) vulnerabilities in the RSS module in PostNuke 0.750 and 0.760RC2 and RC3 allow remote attackers to inject arbitrary web script or HTML via the (1) rss_url parameter to magpie_slashbox.php, or the url parameter to (2) magpie_simple.php or (3) magpie_debug.php. | ||||
CVE-2005-1694 | 1 Postnuke Software Foundation | 1 Postnuke | 2025-04-03 | N/A |
Multiple SQL injection vulnerabilities in Xanthia.php in the Xanthia module in PostNuke 0.750 allow remote attackers to execute arbitrary SQL commands via the (1) name or (2) module parameter. | ||||
CVE-2002-2015 | 1 Postnuke Software Foundation | 1 Postnuke | 2025-04-03 | N/A |
PHP file inclusion vulnerability in user.php in PostNuke 0.703 allows remote attackers to include arbitrary files and possibly execute code via the caselist parameter. | ||||
CVE-2005-1621 | 1 Postnuke Software Foundation | 1 Postnuke | 2025-04-03 | N/A |
Directory traversal vulnerability in the pnModFunc function in pnMod.php for PostNuke 0.750 through 0.760rc4 allows remote attackers to read arbitrary files via a .. (dot dot) in the func parameter to index.php. | ||||
CVE-2005-0617 | 1 Postnuke Software Foundation | 1 Postnuke | 2025-04-03 | N/A |
SQL injection vulnerability in dl-search.php in PostNuke 0.750 and 0.760-RC2 allows remote attackers to execute arbitrary SQL commands via the show parameter. | ||||
CVE-2002-0739 | 1 Postnuke Software Foundation | 1 Postcalendar | 2025-04-03 | N/A |
Cross-site scripting in PostCalendar 3.02 allows remote attackers to insert arbitrary HTML and script, and steal cookies, by modifying a calendar entry in its preview page. | ||||
CVE-2005-0616 | 1 Postnuke Software Foundation | 1 Postnuke Phoenix | 2025-04-03 | N/A |
Multiple cross-site scripting (XSS) vulnerabilities in the Download module for PostNuke 0.750 and 0.760-RC2 allow remote attackers to inject arbitrary web script or HTML via the (1) Program name, (2) File link, (3) Author name (4) Author e-mail address, (5) File size, (6) Version, or (7) Home page variables. |