Skip to content
Noroxi

cutephp records

39 published records for vendor cutephp.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
6
With a fix record
0%
Median publish → KEV
No record has entered KEV

Records by year

  1. 19
  2. 20

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

39 records
  • CVE-2008-4557
    54Plan

    plugins/wacko/highlight/html.php in Strawberry in CuteNews.ru 1.1.1 (aka Strawberry) allows remote attackers to execute arbitrary PHP code v

    CriticalCVSS 10.0Proof of conceptEPSS 45%

    cutephp · cutenewsOct 14, 2008

  • CVE-2019-11447
    51Plan

    An issue was discovered in CutePHP CuteNews 2.1.2.

    HighCVSS 8.8Proof of conceptEPSS 52%

    cutephp · cutenewsApr 22, 2019

  • CVE-2020-5558
    36Monitor

    CuteNews 2.0.1 allows remote authenticated attackers to execute arbitrary PHP code via unspecified vectors.

    HighCVSS 8.8No exploitEPSS 2%

    cutephp · cutenewsMar 24, 2020

  • CVE-2003-1240
    32Monitor

    PHP remote file inclusion vulnerability in CuteNews 0.88 allows remote attackers to execute arbitrary PHP code via a URL in the cutepath par

    HighCVSS 7.5Proof of conceptEPSS 6%

    cutephp · cutenewsDec 31, 2003

  • CVE-2005-3010
    32Monitor

    Direct static code injection vulnerability in the flood protection feature in inc/shows.inc.php in CuteNews 1.4.0 and earlier allows remote

    HighCVSS 7.5Proof of conceptEPSS 6%

    cutephp · cutenewsSep 21, 2005

  • CVE-2006-4445
    31Monitor

    Multiple PHP remote file inclusion vulnerabilities in CuteNews 1.3.x allow remote attackers to execute arbitrary PHP code via a URL in the c

    HighCVSS 7.5No exploitEPSS 1%

    cutephp · cutenewsAug 29, 2006

  • CVE-2004-1660
    31Monitor

    PHP remote file inclusion vulnerability in CuteNews 1.3.6 and earlier allows remote attackers to execute arbitrary PHP code via the cutepath

    HighCVSS 7.5No exploitEPSS 1%

    cutephp · cutenewsAug 30, 2004

  • CVE-2007-1153
    30Monitor

    Multiple PHP remote file inclusion vulnerabilities in CutePHP CuteNews 1.3.6 allow remote attackers to execute arbitrary PHP code via unspec

    HighCVSS 7.5No exploitEPSS 1%

    cutephp · cutenewsMar 2, 2007

  • CVE-2004-0660
    28Monitor

    Cross-site scripting (XSS) vulnerability in (1) show_archives.php, (2) show_news.php, and possibly other php files in CuteNews 1.3.1 allows

    MediumCVSS 6.8Proof of conceptEPSS 3%

    cutephp · cutenewsAug 6, 2004

  • CVE-2006-1121
    28Monitor

    Cross-site scripting (XSS) vulnerability in CuteNews 1.4.1 allows remote attackers to inject arbitrary web script or HTML via the query stri

    MediumCVSS 6.8Proof of conceptEPSS 2%

    cutephp · cutenewsMar 9, 2006

  • CVE-2004-1573
    28Monitor

    The documentation for AJ-Fork 167 implies that users should set permissions for users.db.php to 777, which allows local users to execute arb

    HighCVSS 7.2No exploitEPSS 0%

    aj-fork · aj-forkDec 31, 2004

  • CVE-2009-4115
    27Monitor

    Multiple static code injection vulnerabilities in the Categories module in CutePHP CuteNews 1.4.6 allow remote authenticated users with appl

    MediumCVSS 6.5Proof of conceptEPSS 1%

    cutephp · cutenewsNov 30, 2009

  • CVE-2009-4173
    27Monitor

    Cross-site request forgery (CSRF) vulnerability in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews before 8b allows remote attackers to hijack the

    MediumCVSS 6.8Proof of conceptEPSS 1%

    cutephp · cutenewsDec 2, 2009

  • CVE-2009-4113
    26Monitor

    Static code injection vulnerability in the Categories module in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews before 8b allows remote authentica

    MediumCVSS 6.5No exploitEPSS 1%

    cutephp · cutenewsNov 30, 2009

  • CVE-2006-2250
    25Monitor

    CuteNews 1.4.1 allows remote attackers to obtain sensitive information via a direct request to (1) /inc/show.inc.php or (2) /inc/functions.i

    MediumCVSS 6.4No exploitEPSS 1%

    cutephp · cutenewsMay 9, 2006

  • CVE-2005-3507
    24Monitor

    Directory traversal vulnerability in CuteNews 1.4.1 allows remote attackers to include arbitrary files, execute code, and gain privileges vi

    MediumCVSS 5.0Proof of conceptEPSS 12%

    cutephp · cutenewsNov 6, 2005

  • CVE-2009-4174
    24Monitor

    The editnews module in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews before 8b, when magic_quotes_gpc is disabled, allows remote authenticated u

    MediumCVSS 6.0Proof of conceptEPSS 1%

    cutephp · cutenewsDec 2, 2009

  • CVE-2020-5557
    24Monitor

    Cross-site scripting vulnerability in CuteNews 2.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    MediumCVSS 6.1No exploitEPSS 0%

    cutephp · cutenewsMar 24, 2020

  • CVE-2007-6662
    23Monitor

    Directory traversal vulnerability in file.php in CuteNews 2.6 allows remote attackers to read arbitrary files via a ..

    MediumCVSS 5.8No exploitEPSS 1%

    cutephp · cutenewsJan 4, 2008

  • CVE-2009-4175
    21Monitor

    CutePHP CuteNews 1.4.6 and UTF-8 CuteNews before 8b allows remote attackers to obtain sensitive information via an invalid date value in the

    MediumCVSS 5.0Proof of conceptEPSS 2%

    cutephp · cutenewsDec 2, 2009

  • CVE-2006-1339
    20Monitor

    Directory traversal vulnerability in inc/functions.inc.php in CuteNews 1.4.1 and possibly other versions, when register_globals is enabled,

    MediumCVSS 5.0No exploitEPSS 1%

    cutephp · cutenewsMar 20, 2006

  • CVE-2006-1340
    20Monitor

    CuteNews 1.4.1 and possibly other versions allows remote attackers to obtain the installation path via unspecified vectors involving an inva

    MediumCVSS 5.0No exploitEPSS 1%

    cutephp · cutenewsMar 20, 2006

  • CVE-2005-2394
    20Monitor

    show_news.php in CuteNews 1.3.6 allows remote attackers to obtain the full path of the server via an invalid archive parameter.

    MediumCVSS 5.0No exploitEPSS 1%

    cutephp · cutenewsJul 27, 2005

  • CVE-2005-3592
    20Monitor

    index.php CuteNews 1.4.0 and earlier allows remote attackers to obtain the path of the installation path of the application by triggering an

    MediumCVSS 5.0No exploitEPSS 1%

    cutephp · cutenewsNov 16, 2005

  • CVE-2004-1659
    18Monitor

    Cross-site scripting (XSS) vulnerability in index.php in CuteNews 1.3.6 and earlier allows remote attackers with Administrator, Editor, Jour

    MediumCVSS 4.3Proof of conceptEPSS 3%

    cutephp · cutenewsSep 2, 2004