CVE-2026-36468
MediumCVSS 6.1Summary
CuteNews v2.1.2 has a stored XSS vulnerability in index.php, where an unauthenticated attacker can supply an arbitrarily named URL parameter key containing an URL-encoded XSS payload, leading to script execution in the victim's browser.
Risk Assessment
Risk of script execution in the victim's browser, data theft, and session hijacking.
Recommendation
Update CuteNews to a patched version or apply proper input sanitization.
Other vulnerabilities in CuteNews
See all- CVE-2026-36472Medium
CuteNews v2.1.2 is vulnerable to XSS in the __referer value. An attacker can execute arbitrary JavaScript in the context of an authenticated user's session via a javascript: URI rendered as an unsanitized clickable link on the msg_info page.
- CVE-2026-36471Unknown
Deserialization of Untrusted Data of the __post_data parameter in cn_parse_url() in CuteNews v.2.1.2 allows a remote attacker to inject arbitrary values into internal request variables (including __referer) via a crafted base64-encoded serialized PHP payload submitted as a POST parameter.
- CVE-2026-36470Unknown
CuteNews v.2.1.2 is vulnerable to Cross Site Scripting (XSS) in index.php. The value of the "Referer" header is copied into the response HTML unmodified/unescaped during POST messages to index.php.
- CVE-2026-36469Unknown
CuteNews v.2.1.2 is vulnerable to Server-Side Request Forgery (SSRF) in core/modules/media.php -- upload_from_inet (Media Manager's "Upload by URL" functionality).
- CVE-2026-36467High
In CuteNews v.2.1.2, core/modules/media.php allows unrestricted upload of files with dangerous types. This allows remote authenticated users with access to the Media Manager panel to execute arbitrary code in the context of the web application, leading to remote server access by triggering a reverse shell.
Original NVD description (English source)
Cross-site Scripting (XSS) in index.php in CuteNews v.2.1.2 allows remote unauthenticated attackers to supply an arbitrarily named URL parameter key, with part of its name containing any URL-encoded common XSS payload (such as "><script>alert(1)</script>).