Cross-Site Scripting Vulnerabilities in CutePHP CuteNews by CutePHP
CVE-2009-4249
Currently unrated
What is CVE-2009-4249?
Multiple cross-site scripting (XSS) vulnerabilities exist in CutePHP's CuteNews 1.4.6 when register_globals is enabled and magic_quotes_gpc is disabled. These vulnerabilities can be exploited by remote attackers to inject arbitrary web scripts or HTML. The injection points include the 'lastusername' and 'mod' parameters in index.php, as well as the 'title' parameter in search.php. Addressing these issues is critical to maintaining the security and integrity of web applications utilizing this software.