Executive brief
CuteNews is an open-source content management system for creating and publishing news articles. An attacker can craft a malicious URL containing JavaScript code in a parameter name, which gets reflected back to visitors without sanitization, allowing them to steal session cookies, inject malware, or deface the website content.
Technical details
Reflected XSS vulnerability in index.php allows remote unauthenticated attackers to inject arbitrary JavaScript by supplying a URL parameter whose key contains URL-encoded XSS payloads (e.g., "><script>alert(1)</script>). The parameter name is reflected directly into the HTML response without proper output encoding. This requires no authentication or user interaction beyond visiting a crafted link.
Affected products
- CuteNews CuteNews 2.1.2
Timeline
- 2026-09-21: disclosed