$ cve CVE-2004-0660 JSON

CVE-2004-0660 EXPLOIT

6.8

MEDIUM · CVSS 2.0 · EPSS 3.9% (pctl 90)

Patch early

A public exploit exists.

Description

Cross-site scripting (XSS) vulnerability in (1) show_archives.php, (2) show_news.php, and possibly other php files in CuteNews 1.3.1 allows remote attackers to inject arbitrary script or HTML via the id parameter.

Scoring

CVSS	6.8 (MEDIUM, v2.0)
Vector	AV:N/AC:M/Au:N/C:P/I:P/A:P
EPSS	3.95% — more likely to be exploited than 90% of all CVEs
On CISA KEV	no
Public exploit	yes
Published	2004-08-06
Last modified	2026-06-16

Affected (1)

Vendor	Product
cutephp	cutenews

Public exploits

Source	Title	Date
exploit-db	CuteNews 1.3 - Comment HTML Injection	2004-07-19
exploit-db	CuteNews 1.3.1 - 'show_archives.php' Cross-Site Scripting	2004-07-16
exploit-db	CuteNews 0.88/1.3 - 'example1.php' Cross-Site Scripting	2004-06-28
exploit-db	CuteNews 0.88/1.3 - 'example2.php' Cross-Site Scripting	2004-06-28
exploit-db	CuteNews 0.88/1.3 - 'show_archives.php' Cross-Site Scripting	2004-06-28

References

→ the Explorer · watch your stack · NVD