CVE-2009-4173

Cross-site request forgery CSRF vulnerability in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews before 8b allows remote attackers to hijack the authentication of administrators for requests that create new users, including a new administrator, via an adduser action in the editusers module in index.php...

Cross site scripting

Cross-site scripting XSS vulnerability in index.php in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews 8 and 8b, when magicquotesgpc is disabled, allows remote attackers to inject arbitrary web script or HTML via the body of a news article in an addnews action...

CVE-2009-4174

The editnews module in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews before 8b, when magicquotesgpc is disabled, allows remote authenticated users with Journalist or Editor access to bypass administrative moderation and edit previously submitted articles via a modified id parameter in a doeditnews...

Design/Logic Flaw

The editnews module in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews before 8b, when magicquotesgpc is disabled, allows remote authenticated users with Journalist or Editor access to bypass administrative moderation and edit previously submitted articles via a modified id parameter in a doeditnews...

CVE-2009-4175

The CVE targets CuteNews/CutePHP (UTF-8 CuteNews) prior to or around 8b. It is triggered via an invalid date value in the from_date_day parameter to search.php, which allows remote attackers to induce an error message that reveals the installation path. Affected component: CuteNews/CutePHP’s sear...

CVE-2009-4174

CVE-2009-4174 affects CuteNews: the editnews module in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews prior to 8b. When magic_quotes_gpc is disabled, remote authenticated users with Journalist or Editor access can bypass administrative moderation and edit previously submitted articles by modifying the...

CVE-2009-4173

CVE-2009-4173 affects CuteNews/CuteNews UTF-8 variants (CuteNews 1.4.6 and UTF-8 CuteNews before 8b). The issue is a cross-site request forgery (CSRF) in the adduser action of the editusers module in index.php, which can allow remote attackers to hijack administrator authentication to create new ...

CVE-2009-4172

CVE-2009-4172 is an XSS vulnerability in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews 8/8b where, if magic_quotes_gpc is disabled, an attacker can inject arbitrary script/HTML via the body of a news article in an addnews action. The NVD entry reports a low severity (CVSS v2 base score 2.6) with netw...

CVE-2009-4174

The editnews module in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews before 8b, when magicquotesgpc is disabled, allows remote authenticated users with Journalist or Editor access to bypass administrative moderation and edit previously submitted articles via a modified id parameter in a doeditnews...

CVE-2009-4173

Cross-site request forgery CSRF vulnerability in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews before 8b allows remote attackers to hijack the authentication of administrators for requests that create new users, including a new administrator, via an adduser action in the editusers module in index.php...

CVE-2009-4175

CutePHP CuteNews 1.4.6 and UTF-8 CuteNews before 8b allows remote attackers to obtain sensitive information via an invalid date value in the fromdateday parameter to search.php, which reveals the installation path in an error message...

CVE-2009-4172

Cross-site scripting XSS vulnerability in index.php in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews 8 and 8b, when magicquotesgpc is disabled, allows remote attackers to inject arbitrary web script or HTML via the body of a news article in an addnews action...

CVE-2009-4116

Multiple directory traversal vulnerabilities in CutePHP CuteNews 1.4.6, when magicquotesgpc is disabled, allow remote authenticated users with editor or administrative application access to read arbitrary files via a .. dot dot in the source parameter in a 1 list or 2 editnews action to the...

CVE-2009-4113

Static code injection vulnerability in the Categories module in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews before 8b allows remote authenticated users with application administrative privileges to inject arbitrary PHP code into data/category.db.php via the Category Access field...

Directory traversal

Multiple directory traversal vulnerabilities in CutePHP CuteNews 1.4.6, when magicquotesgpc is disabled, allow remote authenticated users with editor or administrative application access to read arbitrary files via a .. dot dot in the source parameter in a 1 list or 2 editnews action to the...

Code injection

Multiple static code injection vulnerabilities in the Categories module in CutePHP CuteNews 1.4.6 allow remote authenticated users with application administrative privileges to inject arbitrary PHP code into data/category.db.php via the 1 category and 2 Icon URL fields; or 3 inject arbitrary PHP...

CVE-2009-4115

Multiple static code injection vulnerabilities in the Categories module in CutePHP CuteNews 1.4.6 allow remote authenticated users with application administrative privileges to inject arbitrary PHP code into data/category.db.php via the 1 category and 2 Icon URL fields; or 3 inject arbitrary PHP...

Code injection

Static code injection vulnerability in the Categories module in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews before 8b allows remote authenticated users with application administrative privileges to inject arbitrary PHP code into data/category.db.php via the Category Access field...

CVE-2009-4113

Static code injection vulnerability in the Categories module in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews before 8b allows remote authenticated users with application administrative privileges to inject arbitrary PHP code into data/category.db.php via the Category Access field...

CVE-2009-4115

CVE-2009-4115 affects CuteNews/CutePHP (CuteNews 1.4.6). The Categories module is vulnerable to multiple static code injection flaws that allow remote authenticated admins to inject arbitrary PHP code into data/category.db.php (via the category and Icon URL fields) or into data/ipban.php (via the...