CVE-2026-36469

CuteNews v2.1.2 is vulnerable to XSS in the __referer value. An attacker can execute arbitrary JavaScript in the context of an authenticated user's session via a javascript: URI rendered as an unsanitized clickable link on the msg_info page.

Deserialization of Untrusted Data of the __post_data parameter in cn_parse_url() in CuteNews v.2.1.2 allows a remote attacker to inject arbitrary values into internal request variables (including __referer) via a crafted base64-encoded serialized PHP payload submitted as a POST parameter.

CuteNews v.2.1.2 is vulnerable to Cross Site Scripting (XSS) in index.php. The value of the "Referer" header is copied into the response HTML unmodified/unescaped during POST messages to index.php.

CuteNews v2.1.2 has a stored XSS vulnerability in index.php, where an unauthenticated attacker can supply an arbitrarily named URL parameter key containing an URL-encoded XSS payload, leading to script execution in the victim's browser.

In CuteNews v.2.1.2, core/modules/media.php allows unrestricted upload of files with dangerous types. This allows remote authenticated users with access to the Media Manager panel to execute arbitrary code in the context of the web application, leading to remote server access by triggering a reverse shell.