Medium · 4.5 CVE-2005-1876 EUVD-2005-1878GHSA-g2w2-352j-xq39

Direct code injection vulnerability in CuteNews 1.3.6 and earlier allows remote attackers with administrative privileges to execute arbitra…

Published Jun 7, 2005 · Updated Jan 16, 2025 · Assigned by mitre

Description

Direct code injection vulnerability in CuteNews 1.3.6 and earlier allows remote attackers with administrative privileges to execute arbitrary PHP code via certain inputs that are injected into a template (.tpl) file.

References

17030 vdb-entry
20050602 PHP Execution Vulnerability in CuteNews mailing-list
15594 third-party-advisory