CVEvulnerability

CVE-2005-4260

4.3 MEDIUM Published 2005-12-15 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2005-12-15
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N

Description

Interpretation conflict in includes/mainfile.php in PHP-Nuke 7.9 and later allows remote attackers to perform cross-site scripting (XSS) attacks by replacing the ">" in the tag with a "<", which bypasses the regular expressions that sanitize the data, but is automatically corrected by many web browsers. NOTE: it could be argued that this vulnerability is due to a design limitation of many web browsers; if so, then this should not be treated as a vulnerability in PHP-Nuke.

Affected configurations

• francisco burzi php-nuke 7.0 • francisco burzi php-nuke 7.1 • francisco burzi php-nuke 7.2 • francisco burzi php-nuke 7.3 • francisco burzi php-nuke 7.6 • francisco burzi php-nuke 7.7 • francisco burzi php-nuke 7.8 • francisco burzi php-nuke 7.9

Related

Referenced by CWE · observed example (1)

  • CWE-436 Interpretation Conflict weakness

References