nexusphp project records

16 published records for vendor nexusphp project.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 4
With a fix record: 0%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

16 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
39Monitor	CVE-2017-12776No exploit	SQL injection vulnerability in reports.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the delreport paramnexusphp project · nexusphp · CWE-89 pre-auth RCE SQL injection	Critical9.8	—	1.4%	Aug 18, 2017
39Monitor	CVE-2017-12909No exploit	SQL injection vulnerability in modtask.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the userid parametenexusphp project · nexusphp · CWE-89 pre-auth RCE SQL injection	Critical9.8	—	1.4%	Aug 17, 2017
39Monitor	CVE-2017-12910No exploit	SQL injection vulnerability in massmail.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the or parameter.nexusphp project · nexusphp · CWE-89 pre-auth RCE SQL injection	Critical9.8	—	1.3%	Aug 17, 2017
39Monitor	CVE-2017-12908No exploit	SQL injection vulnerability in takeconfirm.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the conusr paranexusphp project · nexusphp · CWE-89 pre-auth RCE SQL injection	Critical9.8	—	1.3%	Aug 17, 2017
39Monitor	CVE-2017-14512No exploit	NexusPHP 1.5.beta5.20120707 has SQL Injection in forummanage.php via the sort parameter in an editforum action, a different vulnerability thnexusphp project · nexusphp · CWE-89 Pre-auth SQL injection	Critical9.8	—	1.1%	Sep 17, 2017
35Monitor	CVE-2017-12838No exploit	Cross-site request forgery (CSRF) vulnerability in NexusPHP 1.5 allows remote attackers to hijack the authentication of users for requests tnexusphp project · nexusphp · CWE-352 Pre-auth CSRF	High8.8	—	0.6%	Sep 7, 2017
24Monitor	CVE-2017-12792Proof of concept	Multiple cross-site request forgery (CSRF) vulnerabilities in NexusPHP 1.5 allow remote attackers to hijack the authentication of administranexusphp project · nexusphp · CWE-79 Pre-auth XSS CSRF	Medium6.1	—	1.2%	Oct 2, 2017
24Monitor	CVE-2017-15305No exploit	XSS exists in NexusPHP 1.5 via the keyword parameter to messages.php.nexusphp project · nexusphp · CWE-79 Pre-auth XSS	Medium6.1	—	0.9%	Oct 14, 2017
24Monitor	CVE-2017-12906No exploit	Multiple cross-site scripting (XSS) vulnerabilities in NexusPHP allow remote attackers to inject arbitrary web script or HTML via the PATH_Inexusphp project · nexusphp · CWE-79 Pre-auth XSS	Medium6.1	—	0.8%	Sep 7, 2017
24Monitor	CVE-2017-14347No exploit	NexusPHP 1.5.beta5.20120707 has XSS in the returnto parameter to fun.php in a delete action.nexusphp project · nexusphp · CWE-79 Pre-auth XSS	Medium6.1	—	0.7%	Sep 12, 2017
24Monitor	CVE-2017-12680No exploit	Cross-Site Scripting (XSS) exists in NexusPHP 1.5 via the type parameter to shoutbox.php.nexusphp project · nexusphp · CWE-79 Pre-auth XSS	Medium6.1	—	0.7%	Aug 18, 2017
24Monitor	CVE-2017-12907No exploit	Cross-Site Scripting (XSS) exists in NexusPHP version v1.5 via the url path to usersearch.php.nexusphp project · nexusphp · CWE-79 Pre-auth XSS	Medium6.1	—	0.7%	Aug 17, 2017
24Monitor	CVE-2017-12798No exploit	Cross-Site Scripting (XSS) exists in NexusPHP version v1.5 via the q parameter to searchsuggest.php.nexusphp project · nexusphp · CWE-79 Pre-auth XSS	Medium6.1	—	0.7%	Aug 10, 2017
24Monitor	CVE-2017-12655No exploit	Cross-Site Scripting (XSS) exists in NexusPHP version v1.5 via the query parameter to log.php in a dailylog action.nexusphp project · nexusphp · CWE-79 Pre-auth XSS	Medium6.1	—	0.7%	Aug 7, 2017
24Monitor	CVE-2017-14534No exploit	Cross Site Scripting (XSS) exists in NexusPHP 1.5.beta5.20120707 via the PATH_INFO to location.php, related to PHP_SELF.nexusphp project · nexusphp · CWE-79 Pre-auth XSS	Medium6.1	—	0.7%	Sep 18, 2017
24Monitor	CVE-2017-12777No exploit	Cross-Site Scripting (XSS) exists in NexusPHP version v1.5 via some parameter to usersearch.php.nexusphp project · nexusphp · CWE-79 Pre-auth XSS	Medium6.1	—	0.6%	Aug 9, 2017

CVE-2017-12776
39Monitor
SQL injection vulnerability in reports.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the delreport param
CriticalCVSS 9.8No exploitEPSS 1%
- pre-auth RCE
- SQL injection
nexusphp project · nexusphpAug 18, 2017
CVE-2017-12909
39Monitor
SQL injection vulnerability in modtask.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the userid paramete
CriticalCVSS 9.8No exploitEPSS 1%
- pre-auth RCE
- SQL injection
nexusphp project · nexusphpAug 17, 2017
CVE-2017-12910
39Monitor
SQL injection vulnerability in massmail.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the or parameter.
CriticalCVSS 9.8No exploitEPSS 1%
- pre-auth RCE
- SQL injection
nexusphp project · nexusphpAug 17, 2017
CVE-2017-12908
39Monitor
SQL injection vulnerability in takeconfirm.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the conusr para
CriticalCVSS 9.8No exploitEPSS 1%
- pre-auth RCE
- SQL injection
nexusphp project · nexusphpAug 17, 2017
CVE-2017-14512
39Monitor
NexusPHP 1.5.beta5.20120707 has SQL Injection in forummanage.php via the sort parameter in an editforum action, a different vulnerability th
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- SQL injection
nexusphp project · nexusphpSep 17, 2017
CVE-2017-12838
35Monitor
Cross-site request forgery (CSRF) vulnerability in NexusPHP 1.5 allows remote attackers to hijack the authentication of users for requests t
HighCVSS 8.8No exploitEPSS 1%
- Pre-auth
- CSRF
nexusphp project · nexusphpSep 7, 2017
CVE-2017-12792
24Monitor
Multiple cross-site request forgery (CSRF) vulnerabilities in NexusPHP 1.5 allow remote attackers to hijack the authentication of administra
MediumCVSS 6.1Proof of conceptEPSS 1%
nexusphp project · nexusphpOct 2, 2017
CVE-2017-15305
24Monitor
XSS exists in NexusPHP 1.5 via the keyword parameter to messages.php.
MediumCVSS 6.1No exploitEPSS 1%
- Pre-auth
- XSS
nexusphp project · nexusphpOct 14, 2017
CVE-2017-12906
24Monitor
Multiple cross-site scripting (XSS) vulnerabilities in NexusPHP allow remote attackers to inject arbitrary web script or HTML via the PATH_I
MediumCVSS 6.1No exploitEPSS 1%
- Pre-auth
- XSS
nexusphp project · nexusphpSep 7, 2017
CVE-2017-14347
24Monitor
NexusPHP 1.5.beta5.20120707 has XSS in the returnto parameter to fun.php in a delete action.
MediumCVSS 6.1No exploitEPSS 1%
- Pre-auth
- XSS
nexusphp project · nexusphpSep 12, 2017
CVE-2017-12680
24Monitor
Cross-Site Scripting (XSS) exists in NexusPHP 1.5 via the type parameter to shoutbox.php.
MediumCVSS 6.1No exploitEPSS 1%
- Pre-auth
- XSS
nexusphp project · nexusphpAug 18, 2017
CVE-2017-12907
24Monitor
Cross-Site Scripting (XSS) exists in NexusPHP version v1.5 via the url path to usersearch.php.
MediumCVSS 6.1No exploitEPSS 1%
- Pre-auth
- XSS
nexusphp project · nexusphpAug 17, 2017
CVE-2017-12798
24Monitor
Cross-Site Scripting (XSS) exists in NexusPHP version v1.5 via the q parameter to searchsuggest.php.
MediumCVSS 6.1No exploitEPSS 1%
- Pre-auth
- XSS
nexusphp project · nexusphpAug 10, 2017
CVE-2017-12655
24Monitor
Cross-Site Scripting (XSS) exists in NexusPHP version v1.5 via the query parameter to log.php in a dailylog action.
MediumCVSS 6.1No exploitEPSS 1%
- Pre-auth
- XSS
nexusphp project · nexusphpAug 7, 2017
CVE-2017-14534
24Monitor
Cross Site Scripting (XSS) exists in NexusPHP 1.5.beta5.20120707 via the PATH_INFO to location.php, related to PHP_SELF.
MediumCVSS 6.1No exploitEPSS 1%
- Pre-auth
- XSS
nexusphp project · nexusphpSep 18, 2017
CVE-2017-12777
24Monitor
Cross-Site Scripting (XSS) exists in NexusPHP version v1.5 via some parameter to usersearch.php.
MediumCVSS 6.1No exploitEPSS 1%
- Pre-auth
- XSS
nexusphp project · nexusphpAug 9, 2017