CuteNews CVE-2026-36472

Requires an authenticated CuteNews user (typically an admin/editor) to view the msg_info page and click an attacker-crafted javascript: link whose payload was injected via the unsanitized __referer value - so exploitation is gated on victim user interaction (UI:R) and an active authenticated session. It is not exploitable server-side or without a victim clicking; impact is confined to the victim's browser session (script execution, session/token theft), not to the CuteNews server. Affected version is CuteNews 2.1.2 (2.0.x codebase); no fixed version is identified in the provided data.

This is a genuinely low-priority XSS. Every exploitation signal points to limited, non-automatable risk: SSVC decision framework rates Exploitation=none, Automatable=no, Technical Impact=partial; there is no EPSS score, no CISA KEV listing, and no confirmed public exploit code. The vendor CVSS (5.2) and my own assessment (~6.1) both cap impact at C:L/I:L (script execution confined to one authenticated user's browser session, no server-side compromise). Note a signal conflict worth verifying: the input CVSS vector is AV:L (local) with AC:H, yet the description explicitly says a 'remote attacker' exploits this - AV:L contradicts the described remote delivery via a crafted javascript: link, and AC:H overstates complexity for a click-through XSS. I assess AV:N/AC:L instead. Both the vendor score and my re-score require victim interaction (UI:R) - the authenticated user must click the malicious link - which is the dominant limiting factor. Net: a real but low-severity issue, not an urgent patch.

An attacker crafts a request/link that plants a javascript: URI in the __referer value, which CuteNews renders as an unsanitized clickable link on the msg_info page. When a logged-in CuteNews user (e.g., an administrator) views that page and clicks the link, attacker-supplied JavaScript executes in their authenticated session, enabling session/CSRF-token theft or actions on their behalf. No public exploit code is confirmed - only a third-party disclosure writeup (UmbraDeorum) is referenced.