Description
Multiple cross-site scripting (XSS) vulnerabilities in search.php in CuteNews 1.4.1 and earlier, and possibly 1.4.5, allow remote attackers to inject arbitrary web script or HTML via the (1) user, (2) story, or (3) title parameters.
Exploits (1)
References (8)
Core 8
Core References
Third Party Advisory vdb-entry
x_refsource_vupen
http://www.vupen.com/english/advisories/2006/1683
Third Party Advisory third-party-advisory
x_refsource_sreason
http://securityreason.com/securityalert/860
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/20026
Third Party Advisory, VDB Entry mailing-list
x_refsource_bugtraq
http://www.securityfocus.com/archive/1/433058/100/0/threaded
Third Party Advisory, VDB Entry vdb-entry
x_refsource_osvdb
http://www.osvdb.org/25304
Exploit, Vendor Advisory x_refsource_misc
http://neosecurityteam.net/index.php?action=advisories&id=21
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/26270
Exploit vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/17850
Scores
EPSS
0.0989
EPSS Percentile
93.0%
Details
Status
published
Products (8)
cutephp/cutenews
0.88
cutephp/cutenews
1.3
cutephp/cutenews
1.3.1
cutephp/cutenews
1.3.2
cutephp/cutenews
1.3.6
cutephp/cutenews
1.4.0
cutephp/cutenews
1.4.5
cutephp/cutenews
< 1.4.1
Published
May 09, 2006
Tracked Since
Feb 18, 2026