汇总 nexusphp 相关全部产品的 CVE 与安全漏洞情报，包括 CVSS、EPSS、公开时间与漏洞情报数据。
历史漏洞主要涉及 SQL 注入与跨站脚本 等问题，部分漏洞可能导致 数据泄露，并影响 软件部署与生产负载 相关场景。
相关漏洞数据主要来源于公开漏洞披露与安全公告，可用于评估历史漏洞暴露面与修复优先级。
| CVE | 摘要 | 来源 | 最高 CVSS | EPSS % | 公开时间 | 更新时间 |
|---|---|---|---|---|---|---|
| CVE-2022-46890 | Weak access control in NexusPHP before 1.7.33 allows a remote authenticated user to edit any post in the forum (this is caused by a lack of checks performed by the /forums.php?action=post page). | [email protected] | 4.3 | 0.64% | 2023-01-19 | 2025-04-03 |
| CVE-2022-46889 | A persistent cross-site scripting (XSS) vulnerability in NexusPHP before 1.7.33 allows remote authenticated attackers to permanently inject arbitrary web script or HTML via the title parameter used in /subtitles.php. | [email protected] | 5.4 | 60.11% | 2023-01-19 | 2025-04-03 |
| CVE-2022-46888 | Multiple reflective cross-site scripting (XSS) vulnerabilities in NexusPHP before 1.7.33 allow remote attackers to inject arbitrary web script or HTML via the secret parameter in /login.php; q parameter in /user-ban-log.php; query parameter in /log.php; text parameter in /moresmiles.php; q parameter in myhr.php; or id parameter in /viewrequests.php. | [email protected] | 6.1 | 1.54% | 2023-01-19 | 2025-04-03 |
| CVE-2022-46887 | Multiple SQL injection vulnerabilities in NexusPHP before 1.7.33 allow remote attackers to execute arbitrary SQL commands via the conuser[] parameter in takeconfirm.php; the delcheater parameter in cheaterbox.php; or the usernw parameter in nowarn.php. | [email protected] | 9.8 | 19.37% | 2023-01-19 | 2025-04-03 |
| CVE-2020-24771 | Incorrect access control in NexusPHP 1.5.beta5.20120707 allows unauthorized attackers to access published content. | [email protected] | 7.5 | 1.98% | 2022-03-30 | 2024-11-21 |
| CVE-2020-24770 | SQL injection vulnerability in modrules.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the id parameter. | [email protected] | 9.8 | 2.40% | 2022-03-30 | 2024-11-21 |
| CVE-2020-24769 | SQL injection vulnerability in takeconfirm.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the classes parameter. | [email protected] | 9.8 | 1.88% | 2022-03-30 | 2024-11-21 |
| CVE-2017-14076 | SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the id parameter to linksmanage.php in an editlink action. | [email protected] | 9.8 | 1.14% | 2017-08-31 | 2026-05-13 |
| CVE-2017-14070 | Cross Site Scripting (XSS) exists in NexusPHP 1.5.beta5.20120707 via the PATH_INFO to ipsearch.php, related to PHP_SELF. | [email protected] | 6.1 | 0.65% | 2017-08-31 | 2026-05-13 |
| CVE-2017-14069 | SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the usernw array parameter to nowarn.php. | [email protected] | 9.8 | 1.19% | 2017-08-31 | 2026-05-13 |
| CVE-2017-13669 | SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the setanswered parameter to staffbox.php. | [email protected] | 9.8 | 1.50% | 2017-08-24 | 2026-05-13 |
| CVE-2017-12679 | SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the delcheater parameter to cheaterbox.php. | [email protected] | 9.8 | 1.50% | 2017-08-24 | 2026-05-13 |
| CVE-2017-12981 | NexusPHP 1.5.beta5.20120707 has SQL Injection in forummanage.php via the sort parameter in an addforum action. | [email protected] | 9.8 | 1.16% | 2017-08-21 | 2026-05-13 |
| CVE-2017-11651 | NexusPHP V1.5 has XSS via a javascript: or data: URL in a UBBCode url tag. | [email protected] | 6.1 | 0.67% | 2017-07-26 | 2026-05-13 |