← Vulnerability feed

Vulnerability record · CVE-2005-2539 · published 10 August 2005

CVE-2005-2539: Flatnuke vulnerability

Flatnuke · Flatnuke

Multiple cross-site scripting (XSS) vulnerabilities in FlatNuke 2.5.5 and possibly earlier versions allow remote attackers to inject arbitrary web script or HTML via the (1) bodycolor, (2) backimage, (3) theme, or (4) logo parameter to structure.php, (5) admin, (6) admin_mail, or (7) back parameter to footer.php, or (8) the message body in a news post.

4.3 CVSS 2.0 Medium EPSS 2.5% · top 15.7%
4.3CVSS 2.0 base score
2.5%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
18References, 2 tagged exploit
16 Jun 2026Last modified by NVD

Description

Multiple cross-site scripting (XSS) vulnerabilities in FlatNuke 2.5.5 and possibly earlier versions allow remote attackers to inject arbitrary web script or HTML via the (1) bodycolor, (2) backimage, (3) theme, or (4) logo parameter to structure.php, (5) admin, (6) admin_mail, or (7) back parameter to footer.php, or (8) the message body in a news post.

AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://marc.info/?l=bugtraq&m=112327238030127&w=2
http://secunia.com/advisories/16330
http://www.osvdb.org/18551
http://www.osvdb.org/18552
http://www.osvdb.org/18553
http://www.rgod.altervista.org/flatnuke.html Exploit
http://www.securityfocus.com/bid/14483
https://exchange.xforce.ibmcloud.com/vulnerabilities/21707
https://exchange.xforce.ibmcloud.com/vulnerabilities/21708
http://marc.info/?l=bugtraq&m=112327238030127&w=2
http://secunia.com/advisories/16330
http://www.osvdb.org/18551
http://www.osvdb.org/18552
http://www.osvdb.org/18553
http://www.rgod.altervista.org/flatnuke.html Exploit
http://www.securityfocus.com/bid/14483
https://exchange.xforce.ibmcloud.com/vulnerabilities/21707
https://exchange.xforce.ibmcloud.com/vulnerabilities/21708

Track CVE-2005-2539 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2005-4448Flatnuke vulnerabilityFlatNuke 2.5.6 verifies authentication credentials based on an MD5 checksum of the admin name and the hashed password rather than the plaintext passw…EPSS 2.8%7.5CVE-2005-1894Flatnuke code injection vulnerabilityDirect code injection vulnerability in FlatNuke 2.5.3 allows remote attackers to execute arbitrary PHP code by placing the code into the Referer head…EPSS 3.7%7.5CVE-2005-0267Flatnuke vulnerabilityindex.php in FlatNuke 2.5.1 allows remote attackers to create an administrator account via carriage returns and #10 in the url_avatar field, which is…EPSS 1.7%7.5CVE-2005-0268Flatnuke vulnerabilityDirect code injection vulnerability in FlatNuke 2.5.1 allows remote attackers to execute arbitrary PHP code by placing the code into the url_avatar f…EPSS 1.5%6.4CVE-2005-2815Flatnuke vulnerabilityprint.php in FlatNuke 2.5.6 allows remote attackers to obtain sensitive information (path disclosure on error) or cause a denial of service (resource…EPSS 1.8%6.4CVE-2005-1892Flatnuke vulnerabilityFlatNuke 2.5.3 allows remote attackers to cause a denial of service or obtain sensitive information via (1) a direct request to foot_news.php, which …EPSS 2.2%5.0CVE-2005-4208Flatnuke vulnerabilityDirectory traversal vulnerability in Flatnuke 2.5.6 allows remote attackers to access arbitrary files via a .. (dot dot) and null byte (%00) in the i…EPSS 8.1%5.0CVE-2005-2813Flatnuke vulnerabilityDirectory traversal vulnerability in FlatNuke 2.5.6 and possibly earlier allows remote attackers to read arbitrary files via ".." sequences and "%00"…EPSS 6.9%

Source: NIST National Vulnerability Database (record CVE-2005-2539), CISA KEV, FIRST EPSS (scores of 2026-09-29). This page is refreshed as NVD updates the record.