CVE DATABASE / CVE-2005-4260
CVE-2005-4260
CVSS 4.3 · MEDIUM
Summary
Interpretation conflict in includes/mainfile.php in PHP-Nuke 7.9 and later allows remote attackers to perform cross-site scripting (XSS) attacks by replacing the ">" in the tag with a "<", which bypasses the regular expressions that sanitize the data, but is automatically corrected by many web browsers. NOTE: it could be argued that this vulnerability is due to a design limitation of many web browsers; if so, then this should not be treated as a vulnerability in PHP-Nuke.
CVSS 2.0 breakdown
| Base score | 4.3 (MEDIUM) |
| Vector | AV:N/AC:M/Au:N/C:N/I:P/A:N |
| Attack vector | NETWORK |
| Attack complexity | MEDIUM |
| Confidentiality | NONE |
| Integrity | PARTIAL |
| Availability | NONE |
Affected products
Francisco_burzi php-nuke
Check this CVE live
Use our free CVE Lookup tool for the latest NVD record, or browse the full CISA KEV catalog.
References
- http://www.securityfocus.com/archive/1/419496/100/0/threaded
- http://www.securityfocus.com/archive/1/419991/100/0/threaded
- http://www.securityfocus.com/bid/15855
Data: NIST NVD. NVD last modified 2026-04-16. Always verify against the vendor advisory before acting.