Vulmon
Recent Vulnerabilities
Product List
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
cutephp cutenews 1.3.6 vulnerabilities and exploits
(subscribe to this query)
7.5
CVSSv2
CVE-2007-1153
Multiple PHP remote file inclusion vulnerabilities in CutePHP CuteNews 1.3.6 allow remote malicious users to execute arbitrary PHP code via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE...
Cutephp Cutenews 1.3.6
7.5
CVSSv2
CVE-2006-4445
Multiple PHP remote file inclusion vulnerabilities in CuteNews 1.3.x allow remote malicious users to execute arbitrary PHP code via a URL in the cutepath parameter to (1) show_news.php or (2) search.php. NOTE: CVE analysis as of 20060829 has not identified any scenarios in which ...
Cutephp Cutenews 1.3.6
Cutephp Cutenews 1.3.2
Cutephp Cutenews 1.3
Cutephp Cutenews 1.3.1
7.5
CVSSv2
CVE-2004-1660
PHP remote file inclusion vulnerability in CuteNews 1.3.6 and previous versions allows remote malicious users to execute arbitrary PHP code via the cutepath parameter to (1) show_archives.php or (2) show_news.php.
Cutephp Cutenews
7.2
CVSSv2
CVE-2004-1573
The documentation for AJ-Fork 167 implies that users should set permissions for users.db.php to 777, which allows local users to execute arbitrary PHP code and gain privileges as the administrator.
Aj-fork Aj-fork 167
Cutephp Cutenews 1.3.6
Cutephp Cutenews 1.3.2
Cutephp Cutenews 0.88
Cutephp Cutenews 1.3
Cutephp Cutenews 1.3.1
5
CVSSv2
CVE-2006-1340
CuteNews 1.4.1 and possibly other versions allows remote malicious users to obtain the installation path via unspecified vectors involving an invalid file path.
Cutephp Cutenews 1.3.6
Cutephp Cutenews 1.3.2
Cutephp Cutenews 0.88
Cutephp Cutenews 1.3
Cutephp Cutenews
Cutephp Cutenews 1.4.0
Cutephp Cutenews 1.3.1
5
CVSSv2
CVE-2005-2394
show_news.php in CuteNews 1.3.6 allows remote malicious users to obtain the full path of the server via an invalid archive parameter.
Cutephp Cutenews 1.3.6
4.6
CVSSv2
CVE-2004-2615
The documentation for CuteNews 1.3.6 and possibly other versions specifies that files under cutenews/data must be manually given world-writable permissions, which allows local users to insert false news, delete news, and possibly gain privileges or have other unknown impact.
Cutephp Cutenews 1.3.6
4.4
CVSSv2
CVE-2005-1876
Direct code injection vulnerability in CuteNews 1.3.6 and previous versions allows remote attackers with administrative privileges to execute arbitrary PHP code via certain inputs that are injected into a template (.tpl) file.
Cutephp Cutenews
4.3
CVSSv2
CVE-2006-6300
Cross-site scripting (XSS) vulnerability in CuteNews 1.3.6 allows remote malicious users to inject arbitrary web script or HTML via the result parameter.
Cutephp Cutenews 1.3.6
1 EDB exploit
4.3
CVSSv2
CVE-2006-2249
Multiple cross-site scripting (XSS) vulnerabilities in search.php in CuteNews 1.4.1 and previous versions, and possibly 1.4.5, allow remote malicious users to inject arbitrary web script or HTML via the (1) user, (2) story, or (3) title parameters.
Cutephp Cutenews 1.4.5
Cutephp Cutenews 1.3.6
Cutephp Cutenews 1.3.2
Cutephp Cutenews 0.88
Cutephp Cutenews 1.3
Cutephp Cutenews
Cutephp Cutenews 1.4.0
Cutephp Cutenews 1.3.1
1 EDB exploit
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-37316
firmware
CVE-2024-30078
CVE-2024-5995
remote code execution
logic flaw
CVE-2024-20693
CVE-2024-37315
CVE-2024-5464
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
1
2
NEXT »