$ cve CVE-2004-1937 JSON

CVE-2004-1937 EXPLOIT

5.0

MEDIUM · CVSS 2.0 · EPSS 8.1% (pctl 95)

Patch early

A public exploit exists.

Description

Multiple directory traversal vulnerabilities in Nuked-KlaN 1.4b and 1.5b allow remote attackers to read or include arbitrary files via .. sequences in (1) the user_langue parameter to index.php or (2) the langue parameter to update.php, or modify arbitrary GLOBAL variables by causing globals.php to be loaded before conf.inc.php via (3) .. sequences in the file parameter with the page parameter set to globals, or (4) ../globals.php in the user_langue parameter, as demonstrated by modifying $nuked[prefix] in the Suggest module.

Scoring

CVSS	5.0 (MEDIUM, v2.0)
Vector	AV:N/AC:L/Au:N/C:P/I:N/A:N
EPSS	8.12% — more likely to be exploited than 95% of all CVEs
On CISA KEV	no
Public exploit	yes
Published	2004-12-31
Last modified	2026-06-16

Affected (1)

Vendor	Product
nuked-klan	nuked-klan

Public exploits

Source	Title	Date
exploit-db	Nuked-klaN 1.x - Multiple Vulnerabilities	2004-04-12

References

→ the Explorer · watch your stack · NVD