PT-2026-96125 · Cutenews · Cutenews
CVE-2026-36468
·
Published
2026-09-21
·
Updated
2026-09-21
CVSS v3.1
6.1
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
CuteNews version 2.1.2
Description
Cross-site Scripting (XSS) occurs in the 'index.php' file. Remote unauthenticated attackers can exploit this by providing an arbitrarily named URL parameter key that contains a URL-encoded XSS payload.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Cutenews