CutePHP CuteNews 2.1.2

CPE Details

CutePHP CuteNews 2.1.2
cutephp
cutenews
2.1.2
2019-09-25
12h51 +00:00
2019-09-25
12h51 +00:00
CPE NVD
Alerte pour un CPE
Restez informé de toutes modifications pour un CPE spécifique.
Gestion des notifications

CPE Name: cpe:2.3:a:cutephp:cutenews:2.1.2:*:*:*:*:*:*:*

Informations

Vendor

cutephp

Product

cutenews

Version

2.1.2

Related CVE

Open and find in CVE List

CVE ID Publié Description Score Gravité
CVE-2019-11447 2019-04-22 02h01 +00:00 An issue was discovered in CutePHP CuteNews 2.1.2. An attacker can infiltrate the server through the avatar upload process in the profile area via the avatar_file field to index.php?mod=main&opt=personal. There is no effective control of $imgsize in /core/modules/dashboard.php. The header content of a file can be changed and the control can be bypassed for code execution. (An attacker can use the GIF header for this.)
8.8
Haute
CVE-2005-3009 2005-09-21 02h00 +00:00 Cross-site scripting (XSS) vulnerability in CuteNews allows remote attackers to inject arbitrary web script or HTML via the mod parameter to index.php.
4.3