PT-2026-96129 · Cutenews · Cutenews
CVE-2026-36472
·
Published
2026-09-21
·
Updated
2026-09-21
CVSS v3.1
5.2
Medium
| Vector | AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
CuteNews version 2.1.2
Description
Cross Site Scripting (XSS) occurs due to improper neutralization of the
referer value. A remote attacker can execute arbitrary JavaScript within the session of an authenticated user by using a javascript: URI, which is rendered as an unsanitized clickable link on the 'msg info' page.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Cutenews