CVE-2006-2249

Multiple cross-site scripting (XSS) vulnerabilities in search.php in CuteNews 1.4.1 and earlier, and possibly 1.4.5, allow remote attackers to inject arbitrary web script or HTML via the (1) user, (2) story, or (3) title parameters.

• http://neosecurityteam.net/index.php?action=advisories&id=21Exploit, Vendor Advisory
• http://secunia.com/advisories/20026Vendor Advisory
• http://securityreason.com/securityalert/860
• http://www.osvdb.org/25304
• http://www.securityfocus.com/archive/1/433058/100/0/threaded
• http://www.securityfocus.com/bid/17850Exploit
• http://www.vupen.com/english/advisories/2006/1683
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26270
• http://neosecurityteam.net/index.php?action=advisories&id=21Exploit, Vendor Advisory
• http://secunia.com/advisories/20026Vendor Advisory
• http://securityreason.com/securityalert/860
• http://www.osvdb.org/25304
• http://www.securityfocus.com/archive/1/433058/100/0/threaded
• http://www.securityfocus.com/bid/17850Exploit
• http://www.vupen.com/english/advisories/2006/1683
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26270

Published

May 9, 2006

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2006-2243Multiple cross-site scripting (XSS) vulnerabilities in Web4F…
• CVE-2006-2244Multiple SQL injection vulnerabilities in Web4Future News Po…
• CVE-2006-2245PHP remote file inclusion vulnerability in auction\auction_c…
• CVE-2006-2246Cross-site scripting (XSS) vulnerability in UBlog 1.6 Access…
• CVE-2006-2247WebCalendar 1.0.1 to 1.0.3 generates different error message…
• CVE-2006-2248Xeneo Web Server 2.2.22.0 allows remote attackers to obtain …
• CVE-2006-2250CuteNews 1.4.1 allows remote attackers to obtain sensitive i…
• CVE-2006-2251SQL injection vulnerability in the do_mmod function in mod.p…
• CVE-2006-2252Cross-site scripting vulnerability in submit.php in OpenFAQ …
• CVE-2006-2253PHP remote file inclusion vulnerability in visible_count_inc…
• CVE-2006-2254Buffer overflow in filecpnt.exe in FileCOPA 1.01 allows remo…
• CVE-2006-2255Multiple SQL injection vulnerabilities in Creative Community…