Francisco Burzi's vulnerability footprint centers on a narrow set of open-source web applications, most prominently PHP-Nuke and Gallery, that have been widely deployed in content-management and photo-sharing contexts. Despite the modest product count, these applications occupy a prominent position in the landscape, and their disclosures frequently acquire public exploit code, reflecting both the accessibility of their codebases and the appeal to exploit developers of commonly deployed web software. The recurring weakness classes—cross-site scripting, SQL injection, CSRF, and exposure of sensitive information—are characteristic of server-side web applications that process user input and manage session state, and they recur across the vendor's product line. Defenders should treat vulnerabilities in these applications as broadly exploitable and prioritize inventory and patching of internet-facing instances; live severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Francisco Burzi over time
Signals from CVEs in this vendor scope (97 CVEs).
97 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2007-1061MEDIUM SQL injection vulnerability in index.php in Francisco Burzi PHP-Nuke 8.0 Final and earlier, when the "HTTP Referers" block is enabled, allows remote attackers to execute arbitrary | Feb 22, 2007 | 6.8 | 60 | NO | YES |
CVE-2005-3792HIGH Multiple SQL injection vulnerabilities in the Search module in PHP-Nuke 7.8, and possibly other versions before 7.9 with patch 3.1, allows remote attackers to execute arbitrary SQL | Nov 24, 2005 | 7.5 | 52 | NO | YES |
CVE-2004-2044HIGH PHP-Nuke 7.3, and other products that use the PHP-Nuke codebase such as the Nuke Cops betaNC PHP-Nuke Bundle, OSCNukeLite 3.1, and OSC2Nuke 7x do not properly use the eregi() PHP f | Jun 1, 2004 | 7.5 | 39 | NO | YES |
CVE-2004-1988HIGH PHP remote file inclusion vulnerability in init.inc.php in Coppermine Photo Gallery 1.2.0 RC4 allows remote attackers to execute arbitrary PHP code by modifying the CPG_M_DIR to re | Apr 30, 2004 | 7.5 | 39 | NO | YES |
CVE-2004-2018HIGH PHP remote file inclusion vulnerability in index.php in Php-Nuke 6.x through 7.3 allows remote attackers to execute arbitrary PHP code by modifying the modpath parameter to referen | Dec 31, 2004 | 7.5 | 37 | NO | YES |
CVE-2003-1210HIGH Multiple SQL injection vulnerabilities in the Downloads module for PHP-Nuke 5.x through 6.5 allow remote attackers to execute arbitrary SQL commands via the (1) lid parameter to th | Dec 31, 2003 | 7.5 | 36 | NO | YES |
CVE-2004-0269MEDIUM SQL injection vulnerability in PHP-Nuke 6.9 and earlier, and possibly 7.x, allows remote attackers to inject arbitrary SQL code and gain sensitive information via (1) the category | Nov 23, 2004 | 6.4 | 35 | NO | YES |
CVE-2004-1914HIGH SQL injection vulnerability in modules.php in NukeCalendar 1.1.a, as used in PHP-Nuke, allows remote attackers to execute arbitrary SQL commands via the eid parameter. | Dec 31, 2004 | 7.5 | 34 | NO | YES |
CVE-2004-0265MEDIUM Cross-site scripting (XSS) vulnerability in modules.php for Php-Nuke 6.x-7.1.0 allows remote attackers to execute arbitrary script as other users via URL-encoded (1) title or (2) f | Nov 23, 2004 | 6.8 | 34 | NO | YES |
CVE-2003-1435HIGH SQL injection vulnerability in PHP-Nuke 5.6 and 6.0 allows remote attackers to execute arbitrary SQL commands via the days parameter to the search module. | Dec 31, 2003 | 7.5 | 34 | NO | YES |
Signals from CVEs in this vendor scope (97 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Francisco Burzi.
Media articles that mention a CVE ID that affects a product developed by Francisco Burzi — matched by CVE ID, not by vendor name.