Show filters
39 Total Results
Displaying 21-30 of 39
Sort by:
Attacker Value
Unknown
CVE-2006-2250
Disclosure Date: May 09, 2006 (last updated October 04, 2023)
CuteNews 1.4.1 allows remote attackers to obtain sensitive information via a direct request to (1) /inc/show.inc.php or (2) /inc/functions.inc.php, which reveal the path in an error message.
0
Attacker Value
Unknown
CVE-2006-1925
Disclosure Date: April 20, 2006 (last updated October 04, 2023)
Directory traversal vulnerability in the editnews module (inc/editnews.mdu) in index.php in CuteNews 1.4.1 allows remote attackers to read or modify files via the source parameter in the (1) editnews or (2) doeditnews action. NOTE: this can also produce resultant XSS when the target file does not exist.
0
Attacker Value
Unknown
CVE-2006-1340
Disclosure Date: March 21, 2006 (last updated February 22, 2025)
CuteNews 1.4.1 and possibly other versions allows remote attackers to obtain the installation path via unspecified vectors involving an invalid file path.
0
Attacker Value
Unknown
CVE-2006-1339
Disclosure Date: March 21, 2006 (last updated February 22, 2025)
Directory traversal vulnerability in inc/functions.inc.php in CuteNews 1.4.1 and possibly other versions, when register_globals is enabled, allows remote attackers to include arbitrary files via a .. (dot dot) sequence and trailing NULL (%00) byte in the archive parameter in an HTTP POST or COOKIE request, which bypasses a sanity check that is only applied to a GET request.
0
Attacker Value
Unknown
CVE-2006-1121
Disclosure Date: March 09, 2006 (last updated February 22, 2025)
Cross-site scripting (XSS) vulnerability in CuteNews 1.4.1 allows remote attackers to inject arbitrary web script or HTML via the query string to index.php.
0
Attacker Value
Unknown
CVE-2006-0885
Disclosure Date: February 25, 2006 (last updated February 22, 2025)
Cross-site scripting (XSS) vulnerability in show_news.php in CuteNews 1.4.1 allows remote attackers to inject arbitrary web script or HTML via the show parameter.
0
Attacker Value
Unknown
CVE-2005-3592
Disclosure Date: November 16, 2005 (last updated February 22, 2025)
index.php CuteNews 1.4.0 and earlier allows remote attackers to obtain the path of the installation path of the application by triggering an error message, such as by entering multiple ../ (dot dot slash) in the archive parameter.
0
Attacker Value
Unknown
CVE-2005-3507
Disclosure Date: November 06, 2005 (last updated February 22, 2025)
Directory traversal vulnerability in CuteNews 1.4.1 allows remote attackers to include arbitrary files, execute code, and gain privileges via "../" sequences in the template parameter to (1) show_archives.php and (2) show_news.php.
0
Attacker Value
Unknown
CVE-2005-3010
Disclosure Date: September 21, 2005 (last updated February 22, 2025)
Direct static code injection vulnerability in the flood protection feature in inc/shows.inc.php in CuteNews 1.4.0 and earlier allows remote attackers to execute arbitrary PHP code via the HTTP_CLIENT_IP header (Client-Ip), which is injected into data/flood.db.php.
0
Attacker Value
Unknown
CVE-2005-3009
Disclosure Date: September 21, 2005 (last updated February 22, 2025)
Cross-site scripting (XSS) vulnerability in CuteNews allows remote attackers to inject arbitrary web script or HTML via the mod parameter to index.php.
0
