Executive brief
CuteNews is a content management system for publishing news articles. An attacker can craft a malicious link that, when clicked by an authenticated user, executes arbitrary JavaScript in the user's browser session. This could allow stealing session cookies, redirecting users to phishing sites, or defacing the news content.
Technical details
A Cross-Site Scripting (XSS) vulnerability exists due to improper sanitization of the __referer parameter on the msg_info page, which renders unsanitized user input as clickable links. An unauthenticated attacker can inject a javascript: URI scheme that executes when clicked by an authenticated user, gaining arbitrary JavaScript execution in the victim's authenticated context.
Affected products
- CuteNews CuteNews 2.1.2
Timeline
- 2026-09-21: disclosed