Postnuke Software Foundation vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2008-2012 SQL injection vulnerability in index.php in the PostSchedule 1.0 module for PostNuke allows remote attackers to execute arbitrary SQL commands via the eid paramHigh 7.5 · Apr 29, 2008
• CVE-2007-3584 SQL injection vulnerability in viewforum.php in PNphpBB2 1.2i and earlier for Postnuke allows remote attackers to execute arbitrary SQL commands via the order pHigh 7.5 · Jul 5, 2007
• CVE-2007-3052 SQL injection vulnerability in index.php in the PNphpBB2 1.2i and earlier module for PostNuke allows remote attackers to execute arbitrary SQL commands via the High 7.5 · Jun 5, 2007
• CVE-2007-2492 SQL injection vulnerability in index.php in the v4bJournal module for PostNuke allows remote authenticated users to execute arbitrary SQL commands via the id paHigh 7.5 · May 3, 2007
• CVE-2007-0385 The faq section in PostNuke 0.764 allows remote attackers to obtain sensitive information (the full path) via "unvalidated output" in FAQ/index.php, possibly inHigh 7.8 · Jan 19, 2007
• CVE-2007-0386 Unspecified vulnerability in the rating section in PostNuke 0.764 has unknown impact and attack vectors, related to "an interesting bug."High 10 · Jan 19, 2007
• CVE-2006-6267 PostNuke 0.7.5.0, and certain minor versions, allows remote attackers to obtain sensitive information via a non-numeric value of the stop parameter, which reveaHigh 7.8 · Dec 4, 2006
• CVE-2006-6233 SQL injection vulnerability in the Downloads module for unknown versions of PostNuke allows remote attackers to execute arbitrary SQL commands via the lid paramHigh 7.5 · Dec 2, 2006
• CVE-2006-5733 Directory traversal vulnerability in error.php in PostNuke 0.763 and earlier allows remote attackers to include and execute arbitrary local files via a ..High 7.5 · Nov 6, 2006
• CVE-2006-5121 SQL injection vulnerability in modules/Downloads/admin.php in the Admin section of PostNuke 0.762 allows remote attackers to execute arbitrary SQL commands via High 7.5 · Oct 3, 2006
• CVE-2006-4968 PHP remote file inclusion vulnerability in includes/functions_admin.php in PNphpBB 1.2g allows remote attackers to execute arbitrary PHP code via a URL in the pHigh 7.5 · Sep 24, 2006
• CVE-2005-2690 SQL injection vulnerability in the Downloads module in PostNuke 0.760-RC4b allows PostNuke administrators to execute arbitrary SQL commands via the show parametHigh 7.5 · Aug 24, 2005
• CVE-2005-1777 SQL injection vulnerability in readpmsg.php in PostNuke 0.750 allows remote attackers to execute arbitrary SQL commands via the start parameter.High 7.5 · May 31, 2005
• CVE-2005-1700 SQL injection vulnerability in pnadmin.php in the Xanthia module in PostNuke 0.760-RC3 allows remote administrators to execute arbitrary SQL commands via the riHigh 7.5 · May 24, 2005
• CVE-2005-1694 Multiple SQL injection vulnerabilities in Xanthia.php in the Xanthia module in PostNuke 0.750 allow remote attackers to execute arbitrary SQL commands via the (High 7.5 · May 24, 2005
• CVE-2005-0615 Multiple SQL injection vulnerabilities in (1) index.php, (2) modules.php, or (3) admin.php in PostNuke 0.760-RC2 allow remote attackers to execute arbitrary SQLHigh 7.5 · May 2, 2005
• CVE-2005-0617 SQL injection vulnerability in dl-search.php in PostNuke 0.750 and 0.760-RC2 allows remote attackers to execute arbitrary SQL commands via the show parameter.High 7.5 · May 2, 2005
• CVE-2005-1048 SQL injection vulnerability in modules.php in PostNuke 0.760 RC3 allows remote attackers to execute arbitrary SQL statements via the sid parameter.High 7.5 · May 2, 2005
• CVE-2004-1787 SQL injection vulnerability in PostCalendar 4.0.0 allows remote attackers to execute arbitrary SQL commands via search queries.High 7.5 · Dec 31, 2004
• CVE-2004-1949 SQL injection vulnerability in PostNuke 7.2.6 and earlier allows remote attackers to execute arbitrary SQL via (1) the sif parameter to index.php in the CommentHigh 7.5 · Dec 31, 2004
• CVE-2002-2015 PHP file inclusion vulnerability in user.php in PostNuke 0.703 allows remote attackers to include arbitrary files and possibly execute code via the caselist parHigh 7.5 · Dec 31, 2002
• CVE-2002-0739 Cross-site scripting in PostCalendar 3.02 allows remote attackers to insert arbitrary HTML and script, and steal cookies, by modifying a calendar entry in its pHigh 7.5 · Aug 12, 2002
• CVE-2001-1460 SQL injection vulnerability in article.php in PostNuke 0.62 through 0.64 allows remote attackers to bypass authentication via the user parameter.High 7.5 · Oct 13, 2001