CVE-2008-1903

CVE-2008-1903 affects NewsOffice 1.0 and 1.1. It is a PHP remote file inclusion vulnerability in news_show.php that is triggered when register_globals is enabled, allowing an attacker to supply a URL via the newsoffice_directory parameter to execute arbitrary PHP code on the server.

CVE-2010-2844

CVE-2010-2844 is a cross-site scripting (XSS) vulnerability in NewsOffice 2.0.18, affecting news_show.php where an attacker can inject arbitrary script via the n-cat parameter. The NVD entry indicates a CVSS v2 base score of 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N). Exploitation details are not provided ...