| CVE-2026-55372 | ALTO7.2 | NukeViet: Pre-authentication SSRF via X-Forwarded-Host | 13/07/2026 |
| CVE-2026-54065 | ALTO8.7 | NukeViet: Path Traversal to Arbitrary File Deletion in Edit Comment Function | 13/07/2026 |
| CVE-2026-54064 | ALTO8.7 | NukeViet: Multiple Anti-XSS Filter Bypasses Leading to Stored XSS in News Module | 13/07/2026 |
| CVE-2026-49259 | ALTO8.7 | NukeViet: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 13/07/2026 |
| CVE-2026-48118 | ALTO8.2 | NukeViet: Unauthenticated Reflected XSS in Comment Module | 13/07/2026 |
| CVE-2026-41147 | ALTO8.7 | NukeViet CMS is a multi Content Management System. Versions 4.5.07 and prior contain a Stored Cross-Site Scripting (XSS) vulnerability caused by insufficient server-side input sanitization in the Request class. The application relies primarily on client-side filtering to sanitize HTML tags and attributes in user-submit | 22/05/2026 |
| CVE-2024-36528 | ALTO8.8 | nukeviet v.4.5 and before and nukeviet-egov v.1.2.02 and before have a Deserialization vulnerability which results in code execution via /admin/extensions/download.php and /admin/extensions/upload.php. | 10/06/2024 |
| CVE-2022-3975 | MEDIO6.1 | A vulnerability, which was classified as problematic, has been found in NukeViet CMS. Affected by this issue is the function filterAttr of the file vendor/vinades/nukeviet/Core/Request.php of the component Data URL Handler. The manipulation of the argument attrSubSet leads to cross site scripting. The attack may be lau | 13/11/2022 |
| CVE-2022-30874 | MEDIO5.4 | There is a Cross Site Scripting Stored (XSS) vulnerability in NukeViet CMS before 4.5.02. | 21/06/2022 |
| CVE-2020-22765 | MEDIO6.1 | Cross Site Scripting (XSS) vulnerability in NukeViet cms 4.4.0 via the editor in the News module. | 30/07/2021 |
| CVE-2020-21809 | CRÍTICO9.8 | SQL Injection vulnerability in NukeViet CMS module Shops 4.0.29 and 4.3 via the (1) listid parameter in detail.php and the (2) group_price or groupid parameters in search_result.php. | 30/07/2021 |
| CVE-2020-21808 | CRÍTICO9.8 | SQL Injection vulnerability in NukeViet CMS 4.0.10 - 4.3.07 via:the topicsid parameter in modules/news/admin/addtotopics.php. | 30/07/2021 |
| CVE-2019-7726 | CRÍTICO9.8 | modules/banners/funcs/click.php in NukeViet before 4.3.04 has a SQL INSERT statement with raw header data from an HTTP request (e.g., Referer and User-Agent). | 31/12/2020 |
| CVE-2019-7725 | CRÍTICO9.8 | includes/core/is_user.php in NukeViet before 4.3.04 deserializes the untrusted nvloginhash cookie (i.e., the code relies on PHP's serialization format when JSON can be used to eliminate the risk). | 31/12/2020 |
| CVE-2020-13157 | MEDIO6.5 | modules\users\admin\edit.php in NukeViet 4.4 allows CSRF to change a user's password via an admin/index.php?nv=users&op=edit&userid= URI. The old password is not needed. | 23/06/2020 |
| CVE-2020-13156 | MEDIO6.5 | modules\users\admin\add_user.php in NukeViet 4.4 allows CSRF to add a user account via the admin/index.php?nv=users&op=user_add URI. | 23/06/2020 |
| CVE-2020-13155 | ALTO8.8 | clearsystem.php in NukeViet 4.4 allows CSRF with resultant HTML injection via the deltype parameter to the admin/index.php?nv=webtools&op=clearsystem URI. | 23/06/2020 |