WEB//NEWS versions 1.4 and below suffer from remote SQL injection and cookie manipulation vulnerabilities.