Show filters
12 Total Results
Displaying 1-10 of 12
Sort by:
Attacker Value
Unknown
CVE-2007-1153
Disclosure Date: March 02, 2007 (last updated October 04, 2023)
Multiple PHP remote file inclusion vulnerabilities in CutePHP CuteNews 1.3.6 allow remote attackers to execute arbitrary PHP code via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: issue might overlap CVE-2004-1660 or CVE-2006-4445.
0
Attacker Value
Unknown
CVE-2006-6300
Disclosure Date: December 05, 2006 (last updated October 04, 2023)
Cross-site scripting (XSS) vulnerability in CuteNews 1.3.6 allows remote attackers to inject arbitrary web script or HTML via the result parameter.
0
Attacker Value
Unknown
CVE-2006-4445
Disclosure Date: August 29, 2006 (last updated November 08, 2023)
Multiple PHP remote file inclusion vulnerabilities in CuteNews 1.3.x allow remote attackers to execute arbitrary PHP code via a URL in the cutepath parameter to (1) show_news.php or (2) search.php. NOTE: CVE analysis as of 20060829 has not identified any scenarios in which these vectors could result in remote file inclusion
0
Attacker Value
Unknown
CVE-2006-2249
Disclosure Date: May 09, 2006 (last updated October 04, 2023)
Multiple cross-site scripting (XSS) vulnerabilities in search.php in CuteNews 1.4.1 and earlier, and possibly 1.4.5, allow remote attackers to inject arbitrary web script or HTML via the (1) user, (2) story, or (3) title parameters.
0
Attacker Value
Unknown
CVE-2006-1340
Disclosure Date: March 21, 2006 (last updated February 22, 2025)
CuteNews 1.4.1 and possibly other versions allows remote attackers to obtain the installation path via unspecified vectors involving an invalid file path.
0
Attacker Value
Unknown
CVE-2005-3009
Disclosure Date: September 21, 2005 (last updated February 22, 2025)
Cross-site scripting (XSS) vulnerability in CuteNews allows remote attackers to inject arbitrary web script or HTML via the mod parameter to index.php.
0
Attacker Value
Unknown
CVE-2005-2394
Disclosure Date: July 27, 2005 (last updated February 22, 2025)
show_news.php in CuteNews 1.3.6 allows remote attackers to obtain the full path of the server via an invalid archive parameter.
0
Attacker Value
Unknown
CVE-2005-2393
Disclosure Date: July 27, 2005 (last updated February 22, 2025)
Cross-site scripting (XSS) vulnerability in CuteNews 1.3.6 allows remote attackers to inject arbitrary web script or HTML via (1) the lastusername parameter to index.php or (2) selected_search_arch parameter to search.php.
0
Attacker Value
Unknown
CVE-2004-1573
Disclosure Date: December 31, 2004 (last updated February 22, 2025)
The documentation for AJ-Fork 167 implies that users should set permissions for users.db.php to 777, which allows local users to execute arbitrary PHP code and gain privileges as the administrator.
0
Attacker Value
Unknown
CVE-2004-2615
Disclosure Date: December 31, 2004 (last updated February 22, 2025)
The documentation for CuteNews 1.3.6 and possibly other versions specifies that files under cutenews/data must be manually given world-writable permissions, which allows local users to insert false news, delete news, and possibly gain privileges or have other unknown impact.
0
