CVE-2004-2354: Francisco Burzi PHP-Nuke

Medium severity, CVSS 6.8. EPSS: 1.5% chance of exploitation in the next 30 days.

SQL injection vulnerability in 4nGuestbook 0.92 for PHP-Nuke 6.5 through 6.9 allows remote attackers to modify SQL statements via the entry parameter to modules.php, which can also facilitate cross-site scripting (XSS) attacks when MySQL errors are triggered.

Affected products

• Francisco Burzi PHP-Nuke: version 6.5 only; version 6.5_beta1 only; version 6.5_final only; version 6.5_rc1 only; version 6.5_rc2 only; version 6.5_rc3 only; …
• Warpspeed 4nguestbook: version 0.92 only

Published 2004-12-31. Last modified 2026-06-16.