CVE-2021-30177: Phpnuke PHP-Nuke

Critical severity, CVSS 9.8. EPSS: 2.4% chance of exploitation in the next 30 days.

There is a SQL Injection vulnerability in PHP-Nuke 8.3.3 in the User Registration section, leading to remote code execution. This occurs because the U.S. state is not validated to be two letters, and the OrderBy field is not validated to be one of LASTNAME, CITY, or STATE.

Affected products

• Phpnuke PHP-Nuke: version 8.3.3 only

Published 2021-04-07. Last modified 2026-06-17.