CVE-2004-1930: Francisco Burzi PHP-Nuke

Medium severity, CVSS 4.3. EPSS: 1.7% chance of exploitation in the next 30 days.

Cross-site scripting (XSS) vulnerability in the cookiedecode function in mainfile.php for PHP-Nuke 6.x through 7.2, when themes are used, allows remote attackers to inject arbitrary web script or HTML via a base64-encoded user parameter or cookie.

Affected products

• Francisco Burzi PHP-Nuke: version 6.0 only; version 6.5 only; version 6.5_beta1 only; version 6.5_final only; version 6.5_rc1 only; version 6.5_rc2 only; …

Published 2004-04-12. Last modified 2026-06-16.