$ cve CVE-2005-1000 JSON

CVE-2005-1000 EXPLOIT

4.3

MEDIUM · CVSS 2.0 · EPSS 1.8% (pctl 77)

Patch early

A public exploit exists.

Description

Multiple cross-site scripting (XSS) vulnerabilities in PHP-Nuke 7.6 allow remote attackers to inject arbitrary web script or HTML via (1) the bid parameter to the EmailStats op in banners.pgp, (2) the ratenum parameter in the TopRated and MostPopular actions in the Web_Links module, (3) the ttitle parameter in the viewlinkdetails, viewlinkeditorial, viewlinkcomments, and ratelink actions in the Web_Links module, or (4) the username parameter in the Your_Account module.

Scoring

CVSS	4.3 (MEDIUM, v2.0)
Vector	AV:N/AC:M/Au:N/C:N/I:P/A:N
EPSS	1.77% — more likely to be exploited than 77% of all CVEs
On CISA KEV	no
Public exploit	yes
Published	2005-05-02
Last modified	2026-06-16

Affected (1)

Vendor	Product
francisco burzi	php-nuke

Public exploits

Source	Title	Date
exploit-db	PHP-Nuke 7.6 Web_Links Module - Multiple Cross-Site Scripting Vulnerabilities	2005-04-06
exploit-db	PHP-Nuke 7.6 - 'banners.php' Cross-Site Scripting	2005-04-06
exploit-db	PHP-Nuke 6.x/7.x Your_Account Module - 'Username' Cross-Site Scripting	2005-04-05
exploit-db	PHP-Nuke 6.x/7.x Your_Account Module - Avatarcategory Cross-Site Scripting	2005-04-05

References

→ the Explorer · watch your stack · NVD