$ cve CVE-2005-2539 JSON

CVE-2005-2539 EXPLOIT

4.3

MEDIUM · CVSS 2.0 · EPSS 2.5% (pctl 84)

Patch early

A public exploit exists.

Description

Multiple cross-site scripting (XSS) vulnerabilities in FlatNuke 2.5.5 and possibly earlier versions allow remote attackers to inject arbitrary web script or HTML via the (1) bodycolor, (2) backimage, (3) theme, or (4) logo parameter to structure.php, (5) admin, (6) admin_mail, or (7) back parameter to footer.php, or (8) the message body in a news post.

Scoring

CVSS	4.3 (MEDIUM, v2.0)
Vector	AV:N/AC:M/Au:N/C:N/I:P/A:N
EPSS	2.53% — more likely to be exploited than 84% of all CVEs
On CISA KEV	no
Public exploit	yes
Published	2005-08-10
Last modified	2026-06-16

Affected (1)

Vendor	Product
flatnuke	flatnuke

Public exploits

Source	Title	Date
exploit-db	FlatNuke 2.5.5 - 'structure.php' Multiple Cross-Site Scripting Vulnerabilities	2005-08-05
exploit-db	FlatNuke 2.5.5 - 'footer.php' Multiple Cross-Site Scripting Vulnerabilities	2005-08-05

References

→ the Explorer · watch your stack · NVD