VULNERABILITY INTELLIGENCE

CVE-2005-1876

CVSS score4.5 MEDIUM
EPSS probability0.58%
CISA KEVNot currently listed
Published2005-06-09
Last modified2026-06-16
CVSS vectorCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

Description

Direct code injection vulnerability in CuteNews 1.3.6 and earlier allows remote attackers with administrative privileges to execute arbitrary PHP code via certain inputs that are injected into a template (.tpl) file.

Weakness classification

  • CWE-94: Improper Control of Generation of Code ('Code Injection')

Primary references