$ cve CVE-2004-2293 JSON

CVE-2004-2293 EXPLOIT

4.3

MEDIUM · CVSS 2.0 · EPSS 2% (pctl 80)

Patch early

A public exploit exists.

Description

Multiple cross-site scripting (XSS) vulnerabilities in PHP-Nuke 6.0 to 7.3 allow remote attackers to inject arbitrary web script or HTML via the (1) eid parameter or (2) query parameter to the Encyclopedia module, (3) preview_review function in the Reviews module as demonstrated by the url, cover, rlanguage, and hits parameters, or (4) savecomment function in the Reviews module, as demonstrated using the uname parameter. NOTE: the Faq/categories and Encyclopedia/ltr issues are already covered by CVE-2005-1023.

Scoring

CVSS	4.3 (MEDIUM, v2.0)
Vector	AV:N/AC:M/Au:N/C:N/I:P/A:N
EPSS	1.97% — more likely to be exploited than 80% of all CVEs
On CISA KEV	no
Public exploit	yes
Published	2004-12-31
Last modified	2026-06-16

Affected (1)

Vendor	Product
francisco burzi	php-nuke

Public exploits

Source	Title	Date
exploit-db	PHP-Nuke 6.x/7.x Encyclopedia Module - Multiple Function Cross-Site Scripting Vulnerabilities	2004-06-11

References

→ the Explorer · watch your stack · NVD