CVE-2005-3010: Cutephp Cutenews

High severity, CVSS 7.5. EPSS: 6.3% chance of exploitation in the next 30 days.

Direct static code injection vulnerability in the flood protection feature in inc/shows.inc.php in CuteNews 1.4.0 and earlier allows remote attackers to execute arbitrary PHP code via the HTTP_CLIENT_IP header (Client-Ip), which is injected into data/flood.db.php.

Affected products

• Cutephp Cutenews: up to and including 1.4.0

Published 2005-09-21. Last modified 2026-06-16.