CVE-2006-2249

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2006-05-09 · updated 2026-06-16

Description

Multiple cross-site scripting (XSS) vulnerabilities in search.php in CuteNews 1.4.1 and earlier, and possibly 1.4.5, allow remote attackers to inject arbitrary web script or HTML via the (1) user, (2) story, or (3) title parameters.

Affected products

CutePHP.com CuteNews: through 1.4.1; 0.88, 1.3, 1.3.1, 1.3.2, 1.3.6, 1.4.0 (+1)

References

http://neosecurityteam.net/index.php?action=advisories&id=21
http://secunia.com/advisories/20026
http://securityreason.com/securityalert/860
http://www.osvdb.org/25304
http://www.securityfocus.com/archive/1/433058/100/0/threaded
http://www.securityfocus.com/bid/17850
http://www.vupen.com/english/advisories/2006/1683
https://exchange.xforce.ibmcloud.com/vulnerabilities/26270
http://neosecurityteam.net/index.php?action=advisories&id=21
http://secunia.com/advisories/20026
http://securityreason.com/securityalert/860
http://www.osvdb.org/25304

Get alerted when CVE-2006-2249 or the next vulnerability affects your stack