Vulnerability in Cutephp Cutenews
CVE-2005-0645
Cross-site scripting (XSS) vulnerability in show.inc.php in cuteNews 1.3.6 allows remote attackers to inject arbitrary HTML, web script, and PHP code via the (1) CLIENT-IP or (2) X-FORWARDED-FOR header in an HTTP POST request to show_news.php.
EPSS: 0.009 (57.3th percentile) — read the EPSS interpretation.
Affected products
- Cutephp Cutenews — versions 1.3.6
- N/a — versions n/a
References
- cve@mitre.org (x_refsource_MISC)
- cve@mitre.org (mailing-list, x_refsource_BUGTRAQ)