CuteNews CVE-2026-36470

Requires the CuteNews 2.1.2 index.php POST-handling path where the Referer header is copied into the response HTML unescaped. Practical exploitation is limited by three factors: the attacker must induce a victim to trigger a POST request (UI:R) whose Referer header carries the payload - and because browsers populate Referer automatically from the originating page rather than from attacker-supplied links, the attacker typically needs an attacker-controlled or same-site intermediary page to shape the Referer value (the basis for AC:H). No authentication is required (PR:N), but no working exploitation occurs against a passive victim without the crafted delivery context.

This is a genuinely low-priority reflected XSS despite its 5.8 (Medium) CVSS rating. The vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L is network-reachable and unauthenticated (PR:N), but two metrics heavily constrain real-world risk: AC:H and UI:R. Critically, the injection sink is the HTTP Referer header, which a victim's browser sets automatically based on the originating page and which an attacker cannot arbitrarily control in a normal cross-site drive-by - this justifies AC:H and makes practical exploitation awkward (typically requiring a same-site or attacker-hosted intermediary page, or a client that permits Referer manipulation). All exploitation signals point the same direction: EPSS is 0.14% (4th percentile - very low predicted exploitation), the CVE is NOT in CISA KEV, and no verified public exploit code is identified (a third-party 'CVEs-2026-Disclosure' GitHub repo is referenced but its contents are not confirmed as working POC here). No signals conflict; every independent source agrees this is a low-urgency, low-impact reflected XSS. The main caveat is data quality rather than severity: the CPE ('cpe:2.3:a:n/a:n/a:*') and affected-version fields ('n/a n/a') are placeholder junk, so automated version-based detection is unreliable and the affected scope rests solely on the description naming CuteNews v2.1.2.

An attacker crafts a page or request flow that causes a victim's browser to submit a POST to the CuteNews index.php with an attacker-influenced Referer header containing a script payload, which is reflected unescaped into the response and executes in the victim's session. Because the payload rides in the Referer header rather than a directly clickable URL parameter, the attacker must set up an intermediary/hosted context and rely on user interaction (UI:R, AC:H), making delivery non-trivial. No verified public exploit code is identified at time of analysis.