CuteNews CVE-2026-36468

Exploitation targets CuteNews v2.1.2's index.php and requires no authentication (PR:N), but the attacker must get a victim to open a crafted URL (UI:R) whose query-string parameter KEY contains a URL-encoded XSS payload - the injection point is the parameter name itself, not its value. Impact is limited to script execution in the victim's browser session (reflected XSS), so there is no server-side code execution or data compromise. Realistic risk is bounded by the need for user interaction/social engineering and by the product's very small deployment base; there is no indication of non-default configuration being required.

The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N = 6.1 Medium) is a textbook reflected cross-site scripting profile: network-reachable, low complexity, no privileges, but requiring victim interaction (UI:R) and yielding only limited confidentiality/integrity impact with a scope change (S:C, reflecting script execution in the victim's browser context rather than the server). No EPSS score, no CISA KEV listing, and no proof-of-concept exploit are present in the provided intelligence, so this rates as no public exploit identified at time of analysis - there is no evidence of active or automated exploitation. The MITRE-assigned record is thinly sourced (CPE is literally 'n/a', affected version metadata reads 'n/a n/a'), and the only substantive reference is a third-party disclosure repository, not a vendor advisory. Net assessment: a genuine but low-priority reflected XSS in a niche, largely abandoned PHP CMS - real enough to fix on affected instances, but not a widespread-exploitation concern, and its real-world reach is throttled both by product rarity and by the required user interaction.

An attacker crafts a URL to a CuteNews 2.1.2 index.php page in which the NAME of an arbitrary query-string parameter contains a URL-encoded XSS payload (e.g. "><script>alert(1)</script>), then lures a victim into clicking it via phishing or a malicious link. When the victim's browser loads the page, the unsanitized parameter key is reflected into the response and the script executes in their session context. No proof-of-concept beyond the public disclosure write-up is confirmed, and exploitation depends on the victim opening the attacker-supplied link.