CVE-2001-1524

MediumCVSS 4.3/10Last modified Jun 16, 2026

Description

Cross-site scripting (XSS) vulnerability in PHP-Nuke 5.3.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) uname parameter in user.php, (2) ttitle, letter and file parameters in modules.php, (3) subject, story and storyext parameters in submit.php, (4) upload parameter in admin.php and (5) fname parameter in friend.php.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected software

No affected versions have been published.

Timeline

Published: Dec 31, 2001
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2001

CVE-2001-15255.0Directory traversal vulnerability in the comments action in easyNews 1.5 and earlier allows remote attackers to modify news.dat, template.da CVE-2001-15264.3Cross-site scripting (XSS) vulnerability in the comments action in index.php in easyNews 1.5 and earlier allows remote attackers to inject a CVE-2001-15272.1easyNews 1.5 and earlier stores administration passwords in cleartext in settings.php, which allows local users to obtain the passwords and CVE-2001-15285.0AmTote International homebet program returns different error messages when invalid account numbers and PIN codes are provided, which allows CVE-2001-15297.5Buffer overflow in rpc.yppasswdd (yppasswd server) in AIX allows attackers to gain unauthorized access via a long string. NOTE: due to lack CVE-2001-15304.6run.cgi in Webmin 0.80 and 0.88 creates temporary files with world-writable permissions, which allows local users to execute arbitrary comma CVE-2001-15317.5Buffer overflow in Claris Emailer 2.0v2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via an emai CVE-2001-15325.0WebX stores authentication information in the HTTP_REFERER variable, which is included in URL links within bulletin board messages posted by CVE-2001-15335.3Microsoft Internet Security and Acceleration (ISA) Server 2000 allows remote attackers to cause a denial of service via a flood of fragmente CVE-2001-15342.1mod_usertrack in Apache 1.3.11 through 1.3.20 generates session ID's using predictable information including host IP address, system time an CVE-2001-15354.6Slashcode 2.0 creates new accounts with an 8-character random password, which could allow local users to obtain session ID's from cookies an CVE-2001-15367.5Autogalaxy stores usernames and passwords in cleartext in cookies, which makes it easier for remote attackers to obtain authentication infor