GCVE - cpe:2.3:a:cutephp:cutenews:1.4.6:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:cutephp:cutenews:1.4.6:*:*:*:*:*:*:*

part: a version: 1.4.6 update: *

Vendor	Cutephp (`a692a090-00ed-5357-98ad-5b13d17bcde5`)
Product	Cutenews (`cae2078f-4e2c-5256-a7c5-ff7255023922`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/cutenews/cutenews-2.0`	purl2cpe	2026-06-01 10:16:22.025456

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2009-4250`	vulnerable	2026-06-08 04:51:47.736879	Details available Multiple cross-site scripting (XSS) vulnerabilities in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews before 8b allow remote attackers to inject arbitrary web script or HTML via (1) the result parameter to register.php; (2) the user parameter to search.php; the (3) cat_msg, (4) source_msg, (5) postponed_selected, (6) unapproved_selected, and (7) news_per_page parameters in a list action to the editnews module of index.php; and (8) the link tag in news comments. NOTE: some of the vulnerabilities require register_globals to be enabled and/or magic_quotes_gpc to be disabled. Published: 2009-12-10T00:00:00.000Z Updated: 2024-08-07T06:54:10.323Z Open on db.gcve.eu Reference links https://exchange.xforce.ibmcloud.com/vulnerabilities/54237 https://exchange.xforce.ibmcloud.com/vulnerabilities/54224 https://exchange.xforce.ibmcloud.com/vulnerabilities/54222 https://exchange.xforce.ibmcloud.com/vulnerabilities/54221 http://www.morningstarsecurity.com/advisories/MORNINGSTAR-2009-02-CuteNews.txt	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2009-4249`	vulnerable	2026-06-08 04:51:47.736482	Details available Multiple cross-site scripting (XSS) vulnerabilities in CutePHP CuteNews 1.4.6, when register_globals is enabled and magic_quotes_gpc is disabled, allow remote attackers to inject arbitrary web script or HTML via the (1) lastusername and (2) mod parameters to index.php; and (3) the title parameter to search.php. Published: 2009-12-10T00:00:00.000Z Updated: 2024-08-07T06:54:10.267Z Open on db.gcve.eu Reference links https://exchange.xforce.ibmcloud.com/vulnerabilities/54222 https://exchange.xforce.ibmcloud.com/vulnerabilities/54220 http://www.morningstarsecurity.com/advisories/MORNINGSTAR-2009-02-CuteNews.txt https://exchange.xforce.ibmcloud.com/vulnerabilities/54219 http://www.securityfocus.com/archive/1/507782/100/0/threaded	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2009-4175`	vulnerable	2026-06-08 04:51:47.492501	Details available CutePHP CuteNews 1.4.6 and UTF-8 CuteNews before 8b allows remote attackers to obtain sensitive information via an invalid date value in the from_date_day parameter to search.php, which reveals the installation path in an error message. Published: 2009-12-02T19:00:00.000Z Updated: 2024-08-07T06:54:09.675Z Open on db.gcve.eu Reference links https://exchange.xforce.ibmcloud.com/vulnerabilities/54235 http://www.morningstarsecurity.com/advisories/MORNINGSTAR-2009-02-CuteNews.txt http://www.securityfocus.com/archive/1/507782/100/0/threaded http://www.securityfocus.com/bid/36971	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2009-4174`	vulnerable	2026-06-08 04:51:47.492179	Details available The editnews module in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews before 8b, when magic_quotes_gpc is disabled, allows remote authenticated users with Journalist or Editor access to bypass administrative moderation and edit previously submitted articles via a modified id parameter in a doeditnews action. Published: 2009-12-02T19:00:00.000Z Updated: 2024-08-07T06:54:09.765Z Open on db.gcve.eu Reference links https://exchange.xforce.ibmcloud.com/vulnerabilities/54236 http://www.morningstarsecurity.com/advisories/MORNINGSTAR-2009-02-CuteNews.txt http://www.securityfocus.com/archive/1/507782/100/0/threaded http://www.securityfocus.com/bid/36971	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2009-4173`	vulnerable	2026-06-08 04:51:47.491825	Details available Cross-site request forgery (CSRF) vulnerability in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews before 8b allows remote attackers to hijack the authentication of administrators for requests that create new users, including a new administrator, via an adduser action in the editusers module in index.php. Published: 2009-12-02T19:00:00.000Z Updated: 2024-08-07T06:54:09.976Z Open on db.gcve.eu Reference links http://www.morningstarsecurity.com/advisories/MORNINGSTAR-2009-02-CuteNews.txt https://exchange.xforce.ibmcloud.com/vulnerabilities/54240 http://www.securityfocus.com/archive/1/507782/100/0/threaded http://www.securityfocus.com/bid/36971	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2009-4172`	vulnerable	2026-06-08 04:51:47.490301	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2009-4116`	vulnerable	2026-06-08 04:51:47.073958	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2009-4115`	vulnerable	2026-06-08 04:51:47.073631	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2009-4113`	vulnerable	2026-06-08 04:51:47.071360	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Cutenews

Notes

PURL mappings

Vulnerability references

Contribute