CVE-2005-1876

MediumCVSS 4.5/10Last modified Jun 16, 2026

Description

Direct code injection vulnerability in CuteNews 1.3.6 and earlier allows remote attackers with administrative privileges to execute arbitrary PHP code via certain inputs that are injected into a template (.tpl) file.

Metrics

CVSS 3.1 4.5/10CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://marc.info/?l=bugtraq&m=111773528322711&w=2Third Party Advisory
http://secunia.com/advisories/15594Broken Link
http://www.osvdb.org/17030Broken Link
http://marc.info/?l=bugtraq&m=111773528322711&w=2Third Party Advisory
http://secunia.com/advisories/15594Broken Link
http://www.osvdb.org/17030Broken Link

Timeline

Published: Jun 9, 2005
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2005

CVE-2005-18774.3Cross-site scripting (XSS) vulnerability in view_ticket.php in Lpanel 1.59 and earlier allows remote attackers to inject arbitrary web scrip CVE-2005-18781.2GIPTables Firewall 1.1 and earlier allows local users to overwrite arbitrary files via a symlink attack on the temp.ip.addresses temporary f CVE-2005-18795.5LutelWall 0.97 and earlier allows local users to overwrite arbitrary files via a symlink attack on a temporary file created by a system call CVE-2005-18805.5everybuddy 0.4.3 and earlier allows local users to overwrite arbitrary files via a symlink attack on a temporary file created by a system ca CVE-2005-18817.5upload.php in YaPiG 0.92b, 0.93u and 0.94u does not properly restrict the file extension for uploaded image files, which allows remote attac CVE-2005-18827.5PHP remote file inclusion vulnerability in last_gallery.php in YaPiG 0.93u and 0.94u allows remote attackers to execute arbitrary PHP code v CVE-2005-18835.0global.php in YaPiG 0.92b allows remote attackers to include arbitrary local files via the BASE_DIR parameter.CVE-2005-18846.4Directory traversal vulnerability in the (1) rmdir or (2) mkdir commands in upload.php in YaPiG 0.92b, 0.93u and 0.94u allows remote attacke CVE-2005-18855.0view.php in YaPiG 0.92b, 0.93u and 0.94u allows remote attackers to obtain sensitive information via a phid parameter that is not an integer CVE-2005-18864.3Cross-site scripting (XSS) vulnerability in view.php in YaPiG 0.92b, 0.93u and 0.94u allows remote attackers to inject arbitrary web script CVE-2005-18874.6Unknown vulnerability in the Sun Solaris C library (libc and libproject) in Solaris 10 allows local users to gain privileges.CVE-2005-18884.3Cross-site scripting (XSS) vulnerability in MediaWiki before 1.4.5 allows remote attackers to inject arbitrary web script via HTML attribute