Cutephp: >> Cutenews >> 1.4.1 Security Vulnerabilities
CuteNews 1.4.1 allows remote attackers to obtain sensitive information via a direct request to (1) /inc/show.inc.php or (2) /inc/functions.inc.php, which reveal the path in an error message.
CVSS Score
6.4
EPSS Score
0.005
Published
2006-05-09
Directory traversal vulnerability in the editnews module (inc/editnews.mdu) in index.php in CuteNews 1.4.1 allows remote attackers to read or modify files via the source parameter in the (1) editnews or (2) doeditnews action. NOTE: this can also produce resultant XSS when the target file does not exist.
CVSS Score
4.3
EPSS Score
0.005
Published
2006-04-20
Cross-site scripting (XSS) vulnerability in CuteNews 1.4.1 allows remote attackers to inject arbitrary web script or HTML via the query string to index.php.
CVSS Score
6.8
EPSS Score
0.07
Published
2006-03-09
Cross-site scripting (XSS) vulnerability in show_news.php in CuteNews 1.4.1 allows remote attackers to inject arbitrary web script or HTML via the show parameter.
CVSS Score
4.3
EPSS Score
0.007
Published
2006-02-25