medium5.8
CVE-2026-36470
CuteNews v.2.1.2 is vulnerable to Cross Site Scripting (XSS) in index.php.
Impact
CuteNews v.2.1.2 is vulnerable to Cross Site Scripting (XSS) in index.php. The value of the "Referer" header is copied into the response HTML unmodified/unescaped during POST messages to index.php.
Affected packages
This record carries no package version data, so it cannot be matched against a dependency list automatically. Read the advisory and compare your version by hand.