CVE-2026-36468

Cross-site Scripting XSS in index.php in CuteNews v.2.1.2 allows remote unauthenticated attackers to supply an arbitrarily named URL parameter key, with part of its name containing any URL-encoded common XSS payload such as "alert1...

CVE-2026-36468: Improper Neutralization of Input During Web Page Generation

Cross-site Scripting XSS in index.php in CuteNews v.2.1.2 allows remote unauthenticated attackers to supply an arbitrarily named URL parameter key, with part of its name containing any URL-encoded common XSS payload such as "...

EUVD-2026-83990

Cross-site Scripting XSS in index.php in CuteNews v.2.1.2 allows remote unauthenticated attackers to supply an arbitrarily named URL parameter key, with part of its name containing any URL-encoded common XSS payload such as "alert1...

CVE-2026-36468

A Cross-site Scripting (XSS) vulnerability exists in the index.php component of CuteNews v.2.1.2 . The root cause is the improper neutralization of input during web page generation , which allows remote unauthenticated attackers to supply an arbitrarily named URL parameter key. If this key contai...