NVD

Id
51395  
Name
CVE-2009-4250  
Description
Multiple cross-site scripting (XSS) vulnerabilities in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews before 8b allow remote attackers to inject arbitrary web script or HTML via (1) the result parameter to register.php; (2) the user parameter to search.php; the (3) cat_msg, (4) source_msg, (5) postponed_selected, (6) unapproved_selected, and (7) news_per_page parameters in a list action to the editnews module of index.php; and (8) the link tag in news comments. NOTE: some of the vulnerabilities require register_globals to be enabled and/or magic_quotes_gpc to be disabled.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:N/I:P/A:N)  
Pub Date
2017-01-07  
Published
2009-12-09  
Modified Date
2010-12-22  
Seq
2009-4250  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
260645 51395 CVE-2009-4250 http://www.morningstarsecurity.com/advisories/MORNINGSTAR-2009-02-CuteNews.txt  View
260646 51395 CVE-2009-4250 20091110 [MORNINGSTAR-2009-02] Multiple security issues in Cute News and UTF-8 Cute News  View
260647 51395 CVE-2009-4250 36971  View
260648 51395 CVE-2009-4250 cutenews-register-xss(54221)  View
260649 51395 CVE-2009-4250 cutenews-search-xss(54222)  View
260650 51395 CVE-2009-4250 cutenews-editnews-xss(54223)  View
260651 51395 CVE-2009-4250 cutenews-newscomments-xss(54224)  View
260652 51395 CVE-2009-4250 cutenews-title-xss(54237)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
42955 JVNDB-2009-003962 CutePHP CuteNews および UTF-8 CuteNews におけるクロスサイトスクリプティングの脆弱性 CutePHP CuteNews および UTF-8 CuteNews には、クロスサイトスクリプティングの脆弱性が存在します。 CVE-2009-4250 41681 CVE-2009-4250 51395 4.3 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-003962.html 2009-12-09 2012-06-26 View