CVE-2005-3010

2005-09-2104:00:00

mitre

www.cve.org

AI Score

7.8

Confidence

Low

EPSS

0.029

Percentile

91.0%

JSON

Direct static code injection vulnerability in the flood protection feature in inc/shows.inc.php in CuteNews 1.4.0 and earlier allows remote attackers to execute arbitrary PHP code via the HTTP_CLIENT_IP header (Client-Ip), which is injected into data/flood.db.php.