Lucene search
K
Database
Vendors
Products
Timeline
Vulnerabilities
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
CutephpCutenews1.4.6

9 matches found

CVE
CVE•added 2009/11/30 9:30 p.m.•47 views

CVE-2009-4115

Multiple static code injection vulnerabilities in the Categories module in CutePHP CuteNews 1.4.6 allow remote authenticated users with application administrative privileges to inject arbitrary PHP code into data/category.db.php via the (1) category and (2) Icon URL fields; or (3) inject arbitrary ...

6.5CVSS7.1AI score0.00816EPSS
CVE
CVE•added 2009/11/30 9:30 p.m.•44 views

CVE-2009-4116

Multiple directory traversal vulnerabilities in CutePHP CuteNews 1.4.6, when magic_quotes_gpc is disabled, allow remote authenticated users with editor or administrative application access to read arbitrary files via a .. (dot dot) in the source parameter in a (1) list or (2) editnews action to the...

3.5CVSS7.3AI score0.00658EPSS
CVE
CVE•added 2009/12/02 7:30 p.m.•44 views

CVE-2009-4175

CutePHP CuteNews 1.4.6 and UTF-8 CuteNews before 8b allows remote attackers to obtain sensitive information via an invalid date value in the from_date_day parameter to search.php, which reveals the installation path in an error message.

5CVSS6.2AI score0.01947EPSS
CVE
CVE•added 2009/12/10 12:30 a.m.•44 views

CVE-2009-4250

Multiple cross-site scripting (XSS) vulnerabilities in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews before 8b allow remote attackers to inject arbitrary web script or HTML via (1) the result parameter to register.php; (2) the user parameter to search.php; the (3) cat_msg, (4) source_msg, (5) postponed...

4.3CVSS5.8AI score0.05888EPSS
CVE
CVE•added 2009/12/02 7:30 p.m.•42 views

CVE-2009-4173

Cross-site request forgery (CSRF) vulnerability in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews before 8b allows remote attackers to hijack the authentication of administrators for requests that create new users, including a new administrator, via an adduser action in the editusers module in index.php...

6.8CVSS7.1AI score0.00178EPSS
CVE
CVE•added 2009/12/10 12:30 a.m.•41 views

CVE-2009-4249

Multiple cross-site scripting (XSS) vulnerabilities in CutePHP CuteNews 1.4.6, when register_globals is enabled and magic_quotes_gpc is disabled, allow remote attackers to inject arbitrary web script or HTML via the (1) lastusername and (2) mod parameters to index.php; and (3) the title parameter t...

2.6CVSS5.8AI score0.03794EPSS
CVE
CVE•added 2009/12/02 7:30 p.m.•36 views

CVE-2009-4172

Cross-site scripting (XSS) vulnerability in index.php in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews 8 and 8b, when magic_quotes_gpc is disabled, allows remote attackers to inject arbitrary web script or HTML via the body of a news article in an addnews action.

2.6CVSS5.7AI score0.00917EPSS
CVE
CVE•added 2009/11/30 9:30 p.m.•34 views

CVE-2009-4113

Static code injection vulnerability in the Categories module in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews before 8b allows remote authenticated users with application administrative privileges to inject arbitrary PHP code into data/category.db.php via the Category Access field.

6.5CVSS6.9AI score0.00478EPSS
CVE
CVE•added 2009/12/02 7:30 p.m.•34 views

CVE-2009-4174

The editnews module in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews before 8b, when magic_quotes_gpc is disabled, allows remote authenticated users with Journalist or Editor access to bypass administrative moderation and edit previously submitted articles via a modified id parameter in a doeditnews ac...

6CVSS6.2AI score0.01085EPSS