CVE-2004-2293

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2004-12-31 · updated 2026-06-16

Description

Multiple cross-site scripting (XSS) vulnerabilities in PHP-Nuke 6.0 to 7.3 allow remote attackers to inject arbitrary web script or HTML via the (1) eid parameter or (2) query parameter to the Encyclopedia module, (3) preview_review function in the Reviews module as demonstrated by the url, cover, rlanguage, and hits parameters, or (4) savecomment function in the Reviews module, as demonstrated using the uname parameter. NOTE: the Faq/categories and Encyclopedia/ltr issues are already covered by CVE-2005-1023.

Affected products

Francisco Burzi Php-Nuke: 6.0, 6.5, 6.5_beta1, 6.5_final, 6.5_rc1, 6.5_rc2 (+9)

References

http://secunia.com/advisories/11852
http://www.osvdb.org/6997
http://www.osvdb.org/6998
http://www.osvdb.org/6999
http://www.securityfocus.com/archive/1/365865
http://www.securityfocus.com/bid/10524
https://exchange.xforce.ibmcloud.com/vulnerabilities/16406
http://secunia.com/advisories/11852
http://www.osvdb.org/6997
http://www.osvdb.org/6998
http://www.osvdb.org/6999
http://www.securityfocus.com/archive/1/365865

Get alerted when CVE-2004-2293 or the next vulnerability affects your stack