CVE-2026-36472
Received Received - Intake

Cross-Site Scripting (XSS) in CuteNews

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: MITRE

Description
CuteNews v.2.1.2 is vulnerable to Cross Site Scripting (XSS). Improper neutralization of the __referer value 2.0.1 allows a remote attacker to execute arbitrary JavaScript in the context of an authenticated user's session via a javascript: URI rendered as an unsanitized clickable link on the msg_info page.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-36472
EUVD
EUVD-2026-83994

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
cutenews cutenews From 2.0.1 (exc)
cutenews cutenews 2.1.2
cutenews cutenews 2.0.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-36472 is a Cross Site Scripting (XSS) vulnerability in CuteNews version 2.1.2. It occurs due to improper neutralization of the __referer value, allowing a remote attacker to inject arbitrary JavaScript code. This JavaScript executes in the context of an authenticated user's session when a crafted javascript: URI is rendered as an unsanitized clickable link on the msg_info page.

Detection Guidance

To detect this vulnerability, inspect CuteNews installations for unsanitized __referer values in the msg_info page. Check for JavaScript URI links rendered as clickable text. Manually review web server logs for suspicious referer headers containing javascript: URIs.

Impact Analysis

This vulnerability allows attackers to execute malicious JavaScript in your browser when you interact with a specially crafted link. This could lead to session hijacking, stealing cookies or sensitive data, performing actions on your behalf, or spreading malware. Users of vulnerable CuteNews instances are at risk if they click untrusted links.

Compliance Impact

This XSS vulnerability could lead to unauthorized access to user data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations using vulnerable CuteNews versions may face compliance violations, legal penalties, and reputational damage due to potential data breaches.

Mitigation Strategies

Upgrade CuteNews to the latest patched version. Apply input validation to sanitize the __referer parameter. Implement Content Security Policy (CSP) headers to restrict inline scripts. Monitor msg_info page for unexpected JavaScript links.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-36472. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart