CVE-2004-2044: PHP-Nuke 7.3, and other products that use the PHP-Nuke codebase such as the Nuke Cops betaNC PHP-Nuke Bundl...

Security readout for executives and security teams

This is a legacy PHP-Nuke issue where access checks can be bypassed because scripts trust a flawed PHP_SELF string check. An attacker may directly reach scripts that should not be called, causing PHP errors that expose server paths and, in some cases, possibly gaining access. The bundle does not provide CVSS, confirmed exploitation, or a named patch. Exposure is most likely on old internet-facing PHP-Nuke 7.3, Nuke Cops betaNC Bundle, OSCNukeLite 3.1, or OSC2Nuke 7x sites, especially if PHP errors are displayed publicly. Modern systems are unlikely affected unless they still host this legacy codebase. Treat this as a legacy exposure cleanup item, not an emergency based on current evidence. Prioritize if any affected software is internet-facing, handles privileged administration, or exposes PHP errors, because unsupported CMS code can create broader operational risk. Mitigation focus: Inventory public sites for PHP-Nuke-derived codebases and listed versions.; Check original vendor or project advisories for any available fixed release.; Retire or replace unsupported PHP-Nuke-derived deployments where feasible..

Prepared

Jun 29, 2026, 20:58 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.