CVE-2005-1049

Multiple cross-site scripting vulnerabilities in PostNuke 0.760-RC3 allow remote attackers to inject arbitrary web script or HTML via the (1) module parameter to admin.php or (2) op parameter to user.php. NOTE: the vendor reports that certain issues could not be reproduced for 760 RC3, or for .750. However, the op/user.php issue exists when the pnAntiCracker setting is disabled.

• http://cvs.postnuke.com/viewcvs.cgi/Historic_PostNuke_Library/postnuke-devel/html/user.php.diff?r1=1.18&r2=1.19Patch
• http://digitalparadox.org/advisories/postnuke.txt
• http://marc.info/?l=bugtraq&m=111298226029957&w=2
• http://news.postnuke.com/modules.php?op=modload&name=News&file=article&sid=2679Patch, Vendor Advisory
• http://secunia.com/advisories/14868/Exploit, Patch, Vendor Advisory
• http://securitytracker.com/id?1013670
• http://www.osvdb.org/15370
• http://www.securityfocus.com/bid/13075Exploit
• http://www.securityfocus.com/bid/13076Exploit, Patch
• https://exchange.xforce.ibmcloud.com/vulnerabilities/20018
• http://cvs.postnuke.com/viewcvs.cgi/Historic_PostNuke_Library/postnuke-devel/html/user.php.diff?r1=1.18&r2=1.19Patch
• http://digitalparadox.org/advisories/postnuke.txt
• http://marc.info/?l=bugtraq&m=111298226029957&w=2
• http://news.postnuke.com/modules.php?op=modload&name=News&file=article&sid=2679Patch, Vendor Advisory
• http://secunia.com/advisories/14868/Exploit, Patch, Vendor Advisory
• http://securitytracker.com/id?1013670
• http://www.osvdb.org/15370
• http://www.securityfocus.com/bid/13075Exploit
• http://www.securityfocus.com/bid/13076Exploit, Patch
• https://exchange.xforce.ibmcloud.com/vulnerabilities/20018

Published

May 2, 2005

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2005-1043exif.c in PHP before 4.3.11 allows remote attackers to cause…
• CVE-2005-1044Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2005-1045OpenText FirstClass 8.0 client does not properly sanitize st…
• CVE-2005-1046Buffer overflow in the kimgio library for KDE 3.4.0 allows r…
• CVE-2005-1047Meilad File upload script (up.php) mod for phpBB 2.0.x does …
• CVE-2005-1048SQL injection vulnerability in modules.php in PostNuke 0.760…
• CVE-2005-1050The modload op in the Reviews module for PostNuke 0.760-RC3 …
• CVE-2005-1051SQL injection vulnerability in profile.php in PunBB 1.2.4 al…
• CVE-2005-1052Microsoft Outlook 2003 and Outlook Web Access (OWA) 2003 do …
• CVE-2005-1053Multiple cross-site scripting (XSS) vulnerabilities in order…
• CVE-2005-1054PHP remote file inclusion vulnerability in news.php in Moder…
• CVE-2005-1055TowerBlog 0.6 and earlier stores the login data file under t…