medium · CVSS v3 5.2
CVE-2026-36472
CuteNews v.2.1.2 is vulnerable to a cross‑site scripting flaw that allows a remote attacker to inject arbitrary JavaScript into the msg_info
Overview
CuteNews v.2.1.2 is vulnerable to a cross‑site scripting flaw that allows a remote attacker to inject arbitrary JavaScript into the msg_info page via an unsanitized __referer value. The flaw can be triggered by a crafted javascript: URI link and only requires the victim to be authenticated. This enables attackers to hijack sessions, steal data, or inject malicious content.
Description
CuteNews v.2.1.2 is vulnerable to Cross Site Scripting (XSS). Improper neutralization of the __referer value 2.0.1 allows a remote attacker to execute arbitrary JavaScript in the context of an authenticated user's session via a javascript: URI rendered as an unsanitized clickable link on the msg_info page.
Impact
The vulnerability permits attackers to execute code in the context of authenticated users, potentially compromising confidentiality and integrity of user data. It can lead to session hijacking, data exfiltration, or malicious content injection. Availability is not directly impacted, but user trust may be eroded.
Remediation
Apply the vendor‑supplied patch for CuteNews v2.1.2 or upgrade to a newer version that sanitizes the __referer value. If a patch is unavailable, implement input validation to escape or reject javascript: URIs, enforce a strict Content Security Policy, and whitelist safe URL schemes. Monitor for suspicious links and educate users to avoid clicking unknown URLs.
Risk context
The CVSS v3 score of 5.2 indicates medium severity. No EPSS data is available, so defenders should treat this as a moderate‑risk issue and prioritize patching or mitigation accordingly.
Affected products
- CuteNews v2.1.2
Scores
- Severity
- medium
- CVSS v2
- 3.7
- CVSS v3
- 5.2
- CVSS v4
- —
- EPSS
- —