Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
cutenews vulnerabilities and exploits
(subscribe to this query)
NA
CVE-2009-4116
Multiple directory traversal vulnerabilities in CutePHP CuteNews 1.4.6, when magic_quotes_gpc is disabled, allow remote authenticated users with editor or administrative application access to read arbitrary files via a .. (dot dot) in the source parameter in a (1) list or (2) edi...
Cutephp Cutenews 1.4.6
NA
CVE-2008-4557
plugins/wacko/highlight/html.php in Strawberry in CuteNews.ru 1.1.1 (aka Strawberry) allows remote malicious users to execute arbitrary PHP code via the text parameter, which is inserted into an executable regular expression.
Cutephp Cutenews 1.1.1
1 EDB exploit
6.1
CVSSv3
CVE-2020-5557
Cross-site scripting vulnerability in CuteNews 2.0.1 allows remote malicious users to inject arbitrary web script or HTML via unspecified vectors.
Cutephp Cutenews 2.0.1
8.8
CVSSv3
CVE-2020-5558
CuteNews 2.0.1 allows remote authenticated malicious users to execute arbitrary PHP code via unspecified vectors.
Cutephp Cutenews 2.0.1
8.8
CVSSv3
CVE-2019-11447
An issue exists in CutePHP CuteNews 2.1.2. An attacker can infiltrate the server through the avatar upload process in the profile area via the avatar_file field to index.php?mod=main&opt=personal. There is no effective control of $imgsize in /core/modules/dashboard.php. The h...
Cutephp Cutenews 2.1.2
8 Github repositories
NA
CVE-2007-6662
Directory traversal vulnerability in file.php in CuteNews 2.6 allows remote malicious users to read arbitrary files via a .. (dot dot) in the file parameter, as demonstrated by reading the admin username and password hash in data/users.db.php.
Cutephp Cutenews 2.6
NA
CVE-2009-4249
Multiple cross-site scripting (XSS) vulnerabilities in CutePHP CuteNews 1.4.6, when register_globals is enabled and magic_quotes_gpc is disabled, allow remote malicious users to inject arbitrary web script or HTML via the (1) lastusername and (2) mod parameters to index.php; and ...
Cutephp Cutenews 1.4.6
2 EDB exploits
NA
CVE-2009-4115
Multiple static code injection vulnerabilities in the Categories module in CutePHP CuteNews 1.4.6 allow remote authenticated users with application administrative privileges to inject arbitrary PHP code into data/category.db.php via the (1) category and (2) Icon URL fields; or (3...
Cutephp Cutenews 1.4.6
1 EDB exploit
NA
CVE-2004-2615
The documentation for CuteNews 1.3.6 and possibly other versions specifies that files under cutenews/data must be manually given world-writable permissions, which allows local users to insert false news, delete news, and possibly gain privileges or have other unknown impact.
Cutephp Cutenews 1.3.6
NA
CVE-2006-1121
Cross-site scripting (XSS) vulnerability in CuteNews 1.4.1 allows remote malicious users to inject arbitrary web script or HTML via the query string to index.php.
Cutephp Cutenews 1.4.1
1 EDB exploit
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2023-7028
memory leak
log injection
CVE-2024-3400
CVE-2022-48695
CVE-2022-48675
CVE-2024-34487
CVE-2024-33792
spoof
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
4
NEXT »