CVE-2026-36472

Summary

The flaw allows a remote attacker to inject arbitrary JavaScript into an authenticated user's session via unsanitized clickable links on the msg_info page, leading to potential data theft or manipulation.

Exploitability

Exploitation is moderately easy as it requires control over a javascript: URI and placement of such a link on the msg_info page. Authentication is needed for the target user to be affected.

Blast radius

If exploited, this could result in unauthorized access to sensitive information or actions within the authenticated user's session.

Prioritized remediation

Update to the latest version of CuteNews which includes fixes for XSS vulnerabilities.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.