CVE-2026-36472
MediumCVSS 5.2Summary
CuteNews v2.1.2 is vulnerable to XSS in the __referer value. An attacker can execute arbitrary JavaScript in the context of an authenticated user's session via a javascript: URI rendered as an unsanitized clickable link on the msg_info page.
Risk Assessment
Potential session hijacking, data theft, and unauthorized actions.
Recommendation
Update CuteNews to the latest patched version or implement proper input sanitization.
Other vulnerabilities in CuteNews
See all- CVE-2026-36471Unknown
Deserialization of Untrusted Data of the __post_data parameter in cn_parse_url() in CuteNews v.2.1.2 allows a remote attacker to inject arbitrary values into internal request variables (including __referer) via a crafted base64-encoded serialized PHP payload submitted as a POST parameter.
- CVE-2026-36470Unknown
CuteNews v.2.1.2 is vulnerable to Cross Site Scripting (XSS) in index.php. The value of the "Referer" header is copied into the response HTML unmodified/unescaped during POST messages to index.php.
- CVE-2026-36469Unknown
CuteNews v.2.1.2 is vulnerable to Server-Side Request Forgery (SSRF) in core/modules/media.php -- upload_from_inet (Media Manager's "Upload by URL" functionality).
- CVE-2026-36468Medium
CuteNews v2.1.2 has a stored XSS vulnerability in index.php, where an unauthenticated attacker can supply an arbitrarily named URL parameter key containing an URL-encoded XSS payload, leading to script execution in the victim's browser.
- CVE-2026-36467High
In CuteNews v.2.1.2, core/modules/media.php allows unrestricted upload of files with dangerous types. This allows remote authenticated users with access to the Media Manager panel to execute arbitrary code in the context of the web application, leading to remote server access by triggering a reverse shell.
Original NVD description (English source)
CuteNews v.2.1.2 is vulnerable to Cross Site Scripting (XSS). Improper neutralization of the __referer value 2.0.1 allows a remote attacker to execute arbitrary JavaScript in the context of an authenticated user's session via a javascript: URI rendered as an unsanitized clickable link on the msg_info page.