rootpwn

medium · CVSS v3 6.1

CVE-2026-36470

CuteNews v.2.1.2 is vulnerable to reflected XSS via the unescaped Referer header in index.php. Attackers can inject malicious scripts into t

Overview

CuteNews v.2.1.2 is vulnerable to reflected XSS via the unescaped Referer header in index.php. Attackers can inject malicious scripts into the page when a user submits a POST request. This flaw can compromise user sessions and deface the site.

Description

CuteNews v.2.1.2 is vulnerable to Cross Site Scripting (XSS) in index.php. The value of the "Referer" header is copied into the response HTML unmodified/unescaped during POST messages to index.php.

Impact

The vulnerability allows attackers to execute arbitrary JavaScript in the context of site visitors, potentially leading to session hijacking, credential theft, or defacement. Web administrators and end‑users are the primary targets.

Remediation

Apply the vendor‑supplied patch or upgrade to a newer version that sanitizes the Referer header. If an upgrade is not immediately possible, configure the web server to strip or encode the Referer header before it reaches the application, and implement output encoding for all user‑controlled data.

Risk context

The CVE has a medium severity (CVSS 6.1) and no EPSS data is available, indicating a moderate but not urgent risk. Defenders should prioritize patching or mitigation in a timely manner.

Affected products

  • CuteNews 2.1.2

Scores

Severity
medium
CVSS v2
4.3
CVSS v3
6.1
CVSS v4
—
EPSS
—

XSS CuteNews Referer input validation web security

← All CVEs

Related CVEs

medium

CVE-2026-69190

Graylog is a free and open log management platform. From 6.3.0 until 6.3.14, 7.0.9, and 7.1.4, the view update API for saved searches and dashboards permits a user with edit permission but without entity ownership to include a shareRequest that grants owner permissions to an arbitrary account. The selected account can then delete the saved search or dashboard or remove the original owner's access. Graylog Cloud was patched before the advisory was published. This issue is fixed in versions 6.3.14, 7.0.9, and 7.1.4.

View analysis

medium

CVE-2026-94210

A flaw has been found in Hyve5 Leantime up to 3.9.8. Affected by this vulnerability is the function getAllGrouped of the file app/Domain/Tickets/Services/Tickets.php of the component Kanban Board. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used. Patch name: a30a6837b4071ac05a4f58d0e1baa2c62aa8695e. To fix this issue, it is recommended to deploy a patch.

View analysis

medium

CVE-2026-94094

OpenClaw up to 2026.9.5 has a denial‑of‑service flaw in the Canvas Host Route that allows remote attackers to crash the server by sending a crafted request that forces the entire file to be buffered. The vulnerability can cause the OpenClaw service to become unresponsive, impacting availability for users and administrators.

View analysis

medium

CVE-2026-94102

WuzhiCMS versions up to 4.1.0 allow an attacker to trigger an open redirect via the Login component by manipulating the forward argument in /index.php?m=member&v=Login. The flaw can be exploited remotely without authentication and may be used to redirect users to malicious sites.

View analysis