Nexusphp Project maintains a single, narrowly scoped BitTorrent tracker application that, despite modest disclosure volume, occupies a prominent position in the self-hosted and private tracker landscape. Vulnerabilities affecting this vendor skew strongly toward critical-severity outcomes and cluster around web-application input handling: cross-site scripting, SQL injection, and cross-site request forgery recur across the codebase, reflecting typical risks in tracker and community-platform software. Defenders deploying or administering Nexusphp instances should treat severity assessments seriously and prioritize web-layer access controls and input sanitization; current exploitation activity and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Nexusphp Project over time
Signals from CVEs in this vendor scope (30 CVEs).
30 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-46889MEDIUM A persistent cross-site scripting (XSS) vulnerability in NexusPHP before 1.7.33 allows remote authenticated attackers to permanently inject arbitrary web script or HTML via the tit | Jan 19, 2023 | 5.4 | 51 | NO | NO |
CVE-2022-46887CRITICAL Multiple SQL injection vulnerabilities in NexusPHP before 1.7.33 allow remote attackers to execute arbitrary SQL commands via the conuser[] parameter in takeconfirm.php; the delche | Jan 19, 2023 | 9.8 | 41 | NO | NO |
CVE-2022-46888MEDIUM Multiple reflective cross-site scripting (XSS) vulnerabilities in NexusPHP before 1.7.33 allow remote attackers to inject arbitrary web script or HTML via the secret parameter in / | Jan 19, 2023 | 6.1 | 31 | NO | YES |
CVE-2020-24770CRITICAL SQL injection vulnerability in modrules.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the id parameter. | Mar 30, 2022 | 9.8 | 31 | NO | NO |
CVE-2020-24769CRITICAL SQL injection vulnerability in takeconfirm.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the classes parameter. | Mar 30, 2022 | 9.8 | 31 | NO | NO |
CVE-2017-12679CRITICAL SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the delcheater parameter to cheaterbox.php. | Aug 24, 2017 | 9.8 | 31 | NO | NO |
CVE-2017-14512CRITICAL NexusPHP 1.5.beta5.20120707 has SQL Injection in forummanage.php via the sort parameter in an editforum action, a different vulnerability than CVE-2017-12981. | Sep 17, 2017 | 9.8 | 29 | NO | NO |
CVE-2017-14076CRITICAL SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the id parameter to linksmanage.php in an editlink action. | Aug 31, 2017 | 9.8 | 29 | NO | NO |
CVE-2017-14069CRITICAL SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the usernw array parameter to nowarn.php. | Aug 31, 2017 | 9.8 | 29 | NO | NO |
CVE-2017-13669CRITICAL SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the setanswered parameter to staffbox.php. | Aug 24, 2017 | 9.8 | 28 | NO | NO |
Signals from CVEs in this vendor scope (30 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Nexusphp Project.
Media articles that mention a CVE ID that affects a product developed by Nexusphp Project — matched by CVE ID, not by vendor name.