utf-8 cutenews vulnerabilities and exploits

(subscribe to this query)

4.3

CVSSv2

Multiple cross-site scripting (XSS) vulnerabilities in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews prior to 8b allow remote malicious users to inject arbitrary web script or HTML via (1) the result parameter to register.php; (2) the user parameter to search.php; the (3) cat_msg, (4...

Korn19 Utf-8 Cutenews 4 Korn19 Utf-8 Cutenews 3 Korn19 Utf-8 Cutenews 7 Korn19 Utf-8 Cutenews 6 Korn19 Utf-8 Cutenews 5 Korn19 Utf-8 Cutenews 2 Cutephp Cutenews 1.4.6 Korn19 Utf-8 Cutenews

2 EDB exploits

2.6

CVSSv2

Cross-site scripting (XSS) vulnerability in index.php in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews 8 and 8b, when magic_quotes_gpc is disabled, allows remote malicious users to inject arbitrary web script or HTML via the body of a news article in an addnews action.

Korn19 Utf-8 Cutenews 8 Korn19 Utf-8 Cutenews 8b Cutephp Cutenews 1.4.6

2 EDB exploits

6

CVSSv2

The editnews module in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews prior to 8b, when magic_quotes_gpc is disabled, allows remote authenticated users with Journalist or Editor access to bypass administrative moderation and edit previously submitted articles via a modified id paramet...

Korn19 Utf-8 Cutenews 8 Cutephp Cutenews 1.4.6

1 EDB exploit

5

CVSSv2

CutePHP CuteNews 1.4.6 and UTF-8 CuteNews prior to 8b allows remote malicious users to obtain sensitive information via an invalid date value in the from_date_day parameter to search.php, which reveals the installation path in an error message.

Cutephp Cutenews 1.4.6 Korn19 Utf-8 Cutenews 8

2 EDB exploits

6.5

CVSSv2

Static code injection vulnerability in the Categories module in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews prior to 8b allows remote authenticated users with application administrative privileges to inject arbitrary PHP code into data/category.db.php via the Category Access field.

Cutephp Cutenews 1.4.6 Korn19 Utf-8 Cutenews 8

6.8

CVSSv2

Cross-site request forgery (CSRF) vulnerability in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews prior to 8b allows remote malicious users to hijack the authentication of administrators for requests that create new users, including a new administrator, via an adduser action in the ed...

Cutephp Cutenews 1.4.6 Korn19 Utf-8 Cutenews 8

2 EDB exploits

2.6

CVSSv2

Multiple cross-site scripting (XSS) vulnerabilities in CutePHP CuteNews 1.4.6, when register_globals is enabled and magic_quotes_gpc is disabled, allow remote malicious users to inject arbitrary web script or HTML via the (1) lastusername and (2) mod parameters to index.php; and ...

Cutephp Cutenews 1.4.6

2 EDB exploits

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook