Vulnerabilities

TI-2009-04034 CVE-2009-4250 · GHSA-f4hj-wx9v-jvfh

Multiple cross-site scripting (XSS) vulnerabilities in CutePHP CuteNews 1.4.6 and UTF-8…

LOW 24

Multiple cross-site scripting (XSS) vulnerabilities in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews before 8b allow remote attackers to inject arbitrary web script or HTML via (1) the result parameter to register.php; (2) t…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01975 Published 2009-12-10 No fix listed CWE-79

TI-2009-03960 CVE-2009-4175 · GHSA-ppxw-5jcr-6xr2

CutePHP CuteNews 1.4.6 and UTF-8 CuteNews before 8b allows remote attackers to obtain…

LOW 28

CutePHP CuteNews 1.4.6 and UTF-8 CuteNews before 8b allows remote attackers to obtain sensitive information via an invalid date value in the from_date_day parameter to search.php, which reveals the installation path in a…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.02785 Published 2009-12-02 No fix listed CWE-200

TI-2009-03959 CVE-2009-4174 · GHSA-5mwm-w4v4-mj5r

The editnews module in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews before 8b, when…

LOW 30

The editnews module in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews before 8b, when magic_quotes_gpc is disabled, allows remote authenticated users with Journalist or Editor access to bypass administrative moderation and ed…

CVSS 2.0MEDIUM 6.0 Network Low privileges Interaction — EPSS 0.01648 Published 2009-12-02 No fix listed CWE-264

TI-2009-03958 CVE-2009-4173 · GHSA-4c74-f2vw-7934

Cross-site request forgery (CSRF) vulnerability in CutePHP CuteNews 1.4.6 and UTF-8…

LOW 32

Cross-site request forgery (CSRF) vulnerability in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews before 8b allows remote attackers to hijack the authentication of administrators for requests that create new users, including…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.01026 Published 2009-12-02 No fix listed CWE-352

TI-2009-03957 CVE-2009-4172 · GHSA-pffx-p9wj-4w76

Cross-site scripting (XSS) vulnerability in index.php in CutePHP CuteNews 1.4.6 and UTF-8…

LOW 16

Cross-site scripting (XSS) vulnerability in index.php in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews 8 and 8b, when magic_quotes_gpc is disabled, allows remote attackers to inject arbitrary web script or HTML via the body…

CVSS 2.0LOW 2.6 Network No auth Interaction — EPSS 0.01596 Published 2009-12-02 No fix listed CWE-79

TI-2009-03902 CVE-2009-4113 · GHSA-9mhc-c22m-9frj

Static code injection vulnerability in the Categories module in CutePHP CuteNews 1.4.6…

LOW 31

Static code injection vulnerability in the Categories module in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews before 8b allows remote authenticated users with application administrative privileges to inject arbitrary PHP cod…

CVSS 2.0MEDIUM 6.5 Network Low privileges Interaction — EPSS 0.0126 Published 2009-11-30 No fix listed CWE-94