CVE-2026-36472: XSS
CuteNews v.2.1.2 is vulnerable to Cross Site Scripting (XSS). Improper neutralization of the referer value 2.0.1 allows a remote attacker to execute arbitrary JavaScript in the context of an authenticated user's session via a javascript: URI rendered as an unsanitized clickable link on the msginfo page.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Authenticated CuteNews users who view the msg_info page are exposed when it renders a malicious __referer value as a clickable link. The attacker can cause JavaScript to run in the context of that authenticated user's session.
What does an attacker need to exploit it?
The attacker needs to supply a crafted __referer value containing a javascript: URI and have an authenticated user reach the affected msg_info page where the value is rendered.
How can I tell whether my deployment is affected?
Check whether the deployment uses CuteNews v.2.1.2 and whether the msg_info page renders the __referer value into a clickable link without neutralizing javascript: URIs.