CVE-2004-2020

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2004-12-31 · updated 2026-06-16

Description

Multiple cross-site scripting (XSS) vulnerabilities in Php-Nuke 6.x through 7.3 allow remote attackers to inject arbitrary HTML or web script into the (1) optionbox parameter in the News module, (2) date parameter in the Statistics module, (3) year, month, and month_1 parameters in the Stories_Archive module, (4) mode, order, and thold parameters in the Surveys module, or (5) a SQL statement to index.php, as processed by mainfile.php.

Affected products

Francisco Burzi Php-Nuke: 6.0, 6.5, 6.5_beta1, 6.5_final, 6.5_rc1, 6.5_rc2 (+9)

References

http://marc.info/?l=bugtraq&m=108482957715299&w=2
http://secunia.com/advisories/11625
http://www.osvdb.org/6225
http://www.osvdb.org/6226
http://www.securityfocus.com/bid/10367
http://www.waraxe.us/index.php?modname=sa&id=29
https://exchange.xforce.ibmcloud.com/vulnerabilities/16172
http://marc.info/?l=bugtraq&m=108482957715299&w=2
http://secunia.com/advisories/11625
http://www.osvdb.org/6225
http://www.osvdb.org/6226
http://www.securityfocus.com/bid/10367

Get alerted when CVE-2004-2020 or the next vulnerability affects your stack