PHP-Nuke versions 6.x, 7.2, and 7.3 all suffer from path disclosure and cross site scripting vulnerabilities.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/33507/advisory-05.txt
Source: https://packetstormsecurity.com/files/33507/advisory-05.txt.html