PHP-Nuke versions 6.x through 7.6 are susceptible to cross site scripting and full path disclosure flaws.