NexusPHP 1.5.beta5.20120707 vulnerabilities

11 known CVE vulnerabilities in NexusPHP 1.5.beta5.20120707, translated and rated.

CVE-2017-12838High
The CSRF vulnerability in NexusPHP 1.5 allows remote attackers to hijack user authentication for specific requests, such as sending manas or adding administrators.
CVE-2017-14512Critical
NexusPHP version 1.5.beta5.20120707 has an SQL Injection vulnerability in forummanage.php via the sort parameter in an editforum action. This is a different vulnerability than CVE-2017-12981.
CVE-2017-14076Critical
SQL Injection exists in NexusPHP version 1.5.beta5.20120707 via the id parameter to linksmanage.php in an editlink action.
CVE-2017-14069Critical
SQL Injection exists in NexusPHP version 1.5.beta5.20120707 via the usernw array parameter to nowarn.php.
CVE-2017-13669Critical
SQL Injection exists in NexusPHP version 1.5.beta5.20120707 via the setanswered parameter to staffbox.php.
CVE-2017-12679Critical
SQL Injection exists in NexusPHP version 1.5.beta5.20120707 via the delcheater parameter to cheaterbox.php.
CVE-2017-12981Critical
NexusPHP version 1.5.beta5.20120707 has an SQL Injection vulnerability in forummanage.php via the sort parameter in an addforum action.
CVE-2017-12776Critical
SQL injection vulnerability in reports.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the delreport parameter.
CVE-2017-12910Critical
CVE-2017-12910 is an SQL injection vulnerability in massmail.php in NexusPHP 1.5 that allows remote attackers to execute arbitrary SQL commands via the or parameter.
CVE-2017-12909Critical
An SQL injection vulnerability in modtask.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the userid parameter.
CVE-2017-12908Critical
SQL injection vulnerability in takeconfirm.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the conusr parameter.