CVE-2009-4172

Name: CVE-2009-4172
Creator: NVD / NIST
Published: 2009-12-02T19:30:00.267+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 1.60%

Last modified Jun 16, 2026

CVE-2009-4172 is a vulnerability of currently unknown severity. Cross-site scripting (XSS) vulnerability in index.php in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews 8 and 8b, when magic_quotes_gpc is disabled, allows remote attackers to inject arbitrary web script or HTML via the body of a news article in an addnews action.. EPSS estimates a 1.60% chance of exploitation in the next 30 days.

Description

Cross-site scripting (XSS) vulnerability in index.php in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews 8 and 8b, when magic_quotes_gpc is disabled, allows remote attackers to inject arbitrary web script or HTML via the body of a news article in an addnews action.

Metrics

EPSS Probability

1.60%

72.7th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-79

Affected Software

Vendor	Product	Versions
Cutephp	Cutenews	1.4.6
Korn19	Utf-8 Cutenews	8
Korn19	Utf-8 Cutenews	8b

References

Timeline

Published: Dec 2, 2009
Last Modified: Jun 16, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2009-4172?

How severe is CVE-2009-4172?

Severity scoring for CVE-2009-4172 is pending analysis. The EPSS model estimates a 1.60% probability of exploitation in the next 30 days.

How do I fix CVE-2009-4172?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2009-4172?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST