CVE-2026-36468: XSS
Cross-site Scripting (XSS) in index.php in CuteNews v.2.1.2 allows remote unauthenticated attackers to supply an arbitrarily named URL parameter key, with part of its name containing any URL-encoded common XSS payload (such as "><script>alert(1)</script>).
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker only needs remote network access to the affected index.php endpoint. No authentication is required, and the payload is supplied through an arbitrarily named URL parameter key whose name contains URL-encoded script content.
Which deployments are exposed?
CuteNews version 2.1.2 deployments that expose index.php to remote users are affected according to the available information. The data does not state whether any particular default installation or configuration limits exposure.
How can I check whether my instance is vulnerable?
Verify whether the deployment is running CuteNews 2.1.2 and whether index.php is remotely reachable. The available information indicates that vulnerable behavior is triggered by a URL parameter name containing a URL-encoded XSS payload.