rootpwn

medium · CVSS v3 5.2

CVE-2026-36472

CuteNews v.2.1.2 is vulnerable to a cross‑site scripting flaw that allows a remote attacker to inject arbitrary JavaScript into the msg_info

Overview

CuteNews v.2.1.2 is vulnerable to a cross‑site scripting flaw that allows a remote attacker to inject arbitrary JavaScript into the msg_info page via an unsanitized __referer value. The flaw can be triggered by a crafted javascript: URI link and only requires the victim to be authenticated. This enables attackers to hijack sessions, steal data, or inject malicious content.

Description

CuteNews v.2.1.2 is vulnerable to Cross Site Scripting (XSS). Improper neutralization of the __referer value 2.0.1 allows a remote attacker to execute arbitrary JavaScript in the context of an authenticated user's session via a javascript: URI rendered as an unsanitized clickable link on the msg_info page.

Impact

The vulnerability permits attackers to execute code in the context of authenticated users, potentially compromising confidentiality and integrity of user data. It can lead to session hijacking, data exfiltration, or malicious content injection. Availability is not directly impacted, but user trust may be eroded.

Remediation

Apply the vendor‑supplied patch for CuteNews v2.1.2 or upgrade to a newer version that sanitizes the __referer value. If a patch is unavailable, implement input validation to escape or reject javascript: URIs, enforce a strict Content Security Policy, and whitelist safe URL schemes. Monitor for suspicious links and educate users to avoid clicking unknown URLs.

Risk context

The CVSS v3 score of 5.2 indicates medium severity. No EPSS data is available, so defenders should treat this as a moderate‑risk issue and prioritize patching or mitigation accordingly.

Affected products

  • CuteNews v2.1.2

Scores

Severity
medium
CVSS v2
3.7
CVSS v3
5.2
CVSS v4
EPSS

XSS CuteNews Authenticated JavaScript URL SessionHijack Mitigation

← All CVEs