Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.3

FlatNuke pages may run malicious scripts from crafted URLs

CVE-2005-2539 · published 21 years ago
Summary

FlatNuke version 2.5.5 and earlier can let an attacker insert harmful web code into several page parameters, such as colors, images, themes, logos, admin settings, footers, and news messages. This could cause unwanted actions on visitors' browsers, like stealing data or hijacking sessions. Update FlatNuke to a patched version or apply the vendor's recommended fixes to stop the injection.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
flatnuke flatnuke 2.5.5
cpe:2.3:a:flatnuke:flatnuke:2.5.5:*:*:*:*:*:*:*
Original advisory text
Multiple cross-site scripting (XSS) vulnerabilities in FlatNuke 2.5.5 and possibly earlier versions allow remote attackers to inject arbitrary web script or HTML via the (1) bodycolor, (2) backimag...
Multiple cross-site scripting (XSS) vulnerabilities in FlatNuke 2.5.5 and possibly earlier versions allow remote attackers to inject arbitrary web script or HTML via the (1) bodycolor, (2) backimage, (3) theme, or (4) logo parameter to structure.php, (5) admin, (6) admin_mail, or (7) back parameter to footer.php, or (8) the message body in a news post.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
4.3 Medium
Exploitation
3% chance of attack within 30 days
Timeline
Published10 Aug 2005
Updated29 Oct 2026
First seen29 Sep 2026
Sources
CVE-2005-2539 · NVD
Track software like this
Free during beta