CVE-2007-1520: Phpnuke PHP-Nuke

Medium severity, CVSS 6.8. EPSS: 0.8% chance of exploitation in the next 30 days.

The cross-site request forgery (CSRF) protection in PHP-Nuke 8.0 and earlier does not ensure the SERVER superglobal is an array before validating the HTTP_REFERER, which allows remote attackers to conduct CSRF attacks.

Affected products

• Phpnuke PHP-Nuke: up to and including 8.0; version 5.6 only; version 6.5 only; version 7.0 only; version 7.1 only; version 7.2 only; …

Published 2007-03-20. Last modified 2026-06-16.