Utf 8 Cutenews
Approved changes feed: RSS · Atom
cpe:2.3:a:korn19:utf-8_cutenews:8:*:*:*:*:*:*:*part: a version: 8 update: *
| Vendor | Korn19 (b2885ebe-8c64-5931-9f61-5927994fb65d) |
|---|---|
| Product | Utf 8 Cutenews (a6d7917c-9c25-5523-85d1-1fdfde16f22e) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/cutenews/cutenews-2.0 |
purl2cpe | 2026-06-01 10:17:03.760902 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2009-4175 |
vulnerable | 2026-06-08 04:51:47.492522 |
Details available
CutePHP CuteNews 1.4.6 and UTF-8 CuteNews before 8b allows remote attackers to obtain sensitive information via an invalid date value in the from_date_day parameter to search.php, which reveals the installation path in an error message.
Published: 2009-12-02T19:00:00.000Z
Updated: 2024-08-07T06:54:09.675Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2009-4174 |
vulnerable | 2026-06-08 04:51:47.492200 |
Details available
The editnews module in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews before 8b, when magic_quotes_gpc is disabled, allows remote authenticated users with Journalist or Editor access to bypass administrative moderation and edit previously submitted articles via a modified id parameter in a doeditnews action.
Published: 2009-12-02T19:00:00.000Z
Updated: 2024-08-07T06:54:09.765Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2009-4173 |
vulnerable | 2026-06-08 04:51:47.491847 |
Details available
Cross-site request forgery (CSRF) vulnerability in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews before 8b allows remote attackers to hijack the authentication of administrators for requests that create new users, including a new administrator, via an adduser action in the editusers module in index.php.
Published: 2009-12-02T19:00:00.000Z
Updated: 2024-08-07T06:54:09.976Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2009-4172 |
vulnerable | 2026-06-08 04:51:47.490327 |
Details available
Cross-site scripting (XSS) vulnerability in index.php in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews 8 and 8b, when magic_quotes_gpc is disabled, allows remote attackers to inject arbitrary web script or HTML via the body of a news article in an addnews action.
Published: 2009-12-02T19:00:00.000Z
Updated: 2024-08-07T06:54:09.782Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2009-4113 |
vulnerable | 2026-06-08 04:51:47.071963 |
Details available
Static code injection vulnerability in the Categories module in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews before 8b allows remote authenticated users with application administrative privileges to inject arbitrary PHP code into data/category.db.php via the Category Access field.
Published: 2009-11-30T21:00:00.000Z
Updated: 2024-08-07T06:54:09.059Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.