CVE-2005-3010

published 2005-09-21

CVE-2005-3010: Direct static code injection vulnerability in the flood protection feature in inc/shows.inc.php in CuteNews 1.4.0 and earlier allows remote attackers to…

Priority P3 47 high 7.5 CVSS 2.0

AV N AC L Au N C P I P A P

EXPLOIT

Direct static code injection vulnerability in the flood protection feature in inc/shows.inc.php in CuteNews 1.4.0 and earlier allows remote attackers to execute arbitrary PHP code via the HTTP_CLIENT_IP header (Client-Ip), which is injected into data/flood.db.php.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
cutephp	cutenews	<= 1.4.0	—

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.