cutephp cutenews 0.88 vulnerabilities and exploits

(subscribe to this query)

Cross-site scripting (XSS) vulnerability in CuteNews allows remote malicious users to inject arbitrary web script or HTML via the mod parameter to index.php.

Cutephp Cutenews 1.3.6 Cutephp Cutenews 1.3.1 Cutephp Cutenews 1.3.2 Cutephp Cutenews Cutephp Cutenews 0.88 Cutephp Cutenews 1.3

Cross-site scripting (XSS) vulnerability in (1) show_archives.php, (2) show_news.php, and possibly other php files in CuteNews 1.3.1 allows remote malicious users to inject arbitrary script or HTML via the id parameter.

Cutephp Cutenews 0.88 Cutephp Cutenews 1.3 Cutephp Cutenews 1.3.1

5 EDB exploits

Cross-site scripting (XSS) vulnerability in index.php in CuteNews 1.3.6 and previous versions allows remote attackers with Administrator, Editor, Journalist or Commenter privileges to inject arbitrary web script or HTML via the mod parameter.

Cutephp Cutenews 1.3.6 Cutephp Cutenews 1.3.1 Cutephp Cutenews 1.3.2 Cutephp Cutenews 0.88 Cutephp Cutenews 1.3

1 EDB exploit

CuteNews 1.4.1 and possibly other versions allows remote malicious users to obtain the installation path via unspecified vectors involving an invalid file path.

Cutephp Cutenews Cutephp Cutenews 0.88 Cutephp Cutenews 1.3 Cutephp Cutenews 1.3.6 Cutephp Cutenews 1.4.0 Cutephp Cutenews 1.3.1 Cutephp Cutenews 1.3.2

Multiple cross-site scripting (XSS) vulnerabilities in search.php in CuteNews 1.4.1 and previous versions, and possibly 1.4.5, allow remote malicious users to inject arbitrary web script or HTML via the (1) user, (2) story, or (3) title parameters.

Cutephp Cutenews 1.3 Cutephp Cutenews 1.3.1 Cutephp Cutenews 0.88 Cutephp Cutenews Cutephp Cutenews 1.3.2 Cutephp Cutenews 1.3.6 Cutephp Cutenews 1.4.0 Cutephp Cutenews 1.4.5

1 EDB exploit

The documentation for AJ-Fork 167 implies that users should set permissions for users.db.php to 777, which allows local users to execute arbitrary PHP code and gain privileges as the administrator.

Cutephp Cutenews 0.88 Cutephp Cutenews 1.3 Cutephp Cutenews 1.3.1 Cutephp Cutenews 1.3.2 Cutephp Cutenews 1.3.6 Aj-fork Aj-fork 167

PHP remote file inclusion vulnerability in CuteNews 0.88 allows remote malicious users to execute arbitrary PHP code via a URL in the cutepath parameter in (1) shownews.php, (2) search.php, or (3) comments.php.

Cutephp Cutenews 0.88

3 EDB exploits

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook