CVE-2006-0907: Francisco Burzi PHP-Nuke

High severity, CVSS 7.5. EPSS: 1.7% chance of exploitation in the next 30 days.

SQL injection vulnerability in PHP-Nuke before 7.8 Patched 3.2 allows remote attackers to execute arbitrary SQL commands via encoded /%2a (/*) sequences in the query string, which bypasses regular expressions that are intended to protect against SQL injection, as demonstrated via the kala parameter.

Affected products

• Francisco Burzi PHP-Nuke: version 7.8 only

Published 2006-02-28. Last modified 2026-06-16.