Show filters
39 Total Results
Displaying 31-39 of 39
Sort by:
Attacker Value
Unknown
CVE-2005-2394
Disclosure Date: July 27, 2005 (last updated February 22, 2025)
show_news.php in CuteNews 1.3.6 allows remote attackers to obtain the full path of the server via an invalid archive parameter.
0
Attacker Value
Unknown
CVE-2005-2393
Disclosure Date: July 27, 2005 (last updated February 22, 2025)
Cross-site scripting (XSS) vulnerability in CuteNews 1.3.6 allows remote attackers to inject arbitrary web script or HTML via (1) the lastusername parameter to index.php or (2) selected_search_arch parameter to search.php.
0
Attacker Value
Unknown
CVE-2005-1876
Disclosure Date: June 09, 2005 (last updated February 22, 2025)
Direct code injection vulnerability in CuteNews 1.3.6 and earlier allows remote attackers with administrative privileges to execute arbitrary PHP code via certain inputs that are injected into a template (.tpl) file.
0
Attacker Value
Unknown
CVE-2004-1573
Disclosure Date: December 31, 2004 (last updated February 22, 2025)
The documentation for AJ-Fork 167 implies that users should set permissions for users.db.php to 777, which allows local users to execute arbitrary PHP code and gain privileges as the administrator.
0
Attacker Value
Unknown
CVE-2004-2615
Disclosure Date: December 31, 2004 (last updated February 22, 2025)
The documentation for CuteNews 1.3.6 and possibly other versions specifies that files under cutenews/data must be manually given world-writable permissions, which allows local users to insert false news, delete news, and possibly gain privileges or have other unknown impact.
0
Attacker Value
Unknown
CVE-2004-1659
Disclosure Date: September 02, 2004 (last updated February 22, 2025)
Cross-site scripting (XSS) vulnerability in index.php in CuteNews 1.3.6 and earlier allows remote attackers with Administrator, Editor, Journalist or Commenter privileges to inject arbitrary web script or HTML via the mod parameter.
0
Attacker Value
Unknown
CVE-2004-1660
Disclosure Date: August 30, 2004 (last updated February 22, 2025)
PHP remote file inclusion vulnerability in CuteNews 1.3.6 and earlier allows remote attackers to execute arbitrary PHP code via the cutepath parameter to (1) show_archives.php or (2) show_news.php.
0
Attacker Value
Unknown
CVE-2004-0660
Disclosure Date: August 06, 2004 (last updated February 22, 2025)
Cross-site scripting (XSS) vulnerability in (1) show_archives.php, (2) show_news.php, and possibly other php files in CuteNews 1.3.1 allows remote attackers to inject arbitrary script or HTML via the id parameter.
0
Attacker Value
Unknown
CVE-2003-1240
Disclosure Date: December 31, 2003 (last updated February 22, 2025)
PHP remote file inclusion vulnerability in CuteNews 0.88 allows remote attackers to execute arbitrary PHP code via a URL in the cutepath parameter in (1) shownews.php, (2) search.php, or (3) comments.php.
0
