Vulnerability Report

CVE-2005-4260

Title: PHP-Nuke includes/mainfile.php interpretation XSS

XSS

Proof Of Concept

PoC Available for CVE-2005-4260

CWE Category NVD-CWE-noinfo
Published Date Dec 15, 2005
Modified Date Jun 16, 2026
Exploit Status Available
Score 4.3 CVSS v2.0
Exploit Probability (EPSS)
2.11%

Vulnerability Summary

CVE-2005-4260: Interpretation conflict in includes/mainfile.php in PHP-Nuke 7.9 and later allows remote attackers to perform cross-site scripting (XSS) attacks by replacing the ">" in the tag with a "<", which bypasses the regular expressions that sanitize the data, but is automatically corrected by many web browsers. NOTE: it could be argued that this vulnerability is due to a design limitation of many web browsers; if so, then this should not be treated as a vulnerability in PHP-Nuke.

Impacted Vendors

F
francisco_burzi 1
P
php-nuke 1

Reference Links

http://www.securityfocus.com/archive/1/419496/100/0/threaded http://www.securityfocus.com/archive/1/419991/100/0/threaded http://www.securityfocus.com/bid/15855 http://www.securityfocus.com/archive/1/419496/100/0/threaded http://www.securityfocus.com/archive/1/419991/100/0/threaded http://www.securityfocus.com/bid/15855
CVSS v2.0
Source Entity [email protected]
Severity MEDIUM
4.3
Access Vector
N/A
Authentication
N/A
RAW VECTOR AV:N/AC:M/Au:N/C:N/I:P/A:N

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2005-4260 Exploits & PoCs (Proof Of Concept)

Exploit-DB https://www.exploit-db.com/exploits/26817
View Code
MODIFIED

Vulnerability data updated via NVD.

MODIFIED

Vulnerability data or affected products updated.

PUBLISHED

Vulnerability first announced in NVD.

Attack Vector Matrix

Access Vector N/A
Complexity N/A
Privileges N/A
Interaction NONE
CVSS Vector String AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected Stack

No specific products linked.