medium4.5
CVE-2005-1876
Direct code injection vulnerability in CuteNews 1.3.6 and earlier allows remote attackers with administrative privileges to execute arbitrary PHP code via cert…
Impact
Direct code injection vulnerability in CuteNews 1.3.6 and earlier allows remote attackers with administrative privileges to execute arbitrary PHP code via certain inputs that are injected into a template (.tpl) file.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Cutephp | Cutenews | through 1.3.6 |