{"id":"CVE-2026-36468","title":"Cross-site Scripting (XSS) in index.php in CuteNews v.2.1.2 allows remote unauthenticated attackers to supply an arbitrarily named URL parameter key, with part of its name containing any URL-encoded common XSS payload (such as \"><script>…","summary":"Cross-site Scripting (XSS) in index.php in CuteNews v.2.1.2 allows remote unauthenticated attackers to supply an arbitrarily named URL parameter key, with part of its name containing any URL-encoded common XSS payload (such as \"><script>…","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cwe":["CWE-79"],"published":"2026-09-21","updated":"2026-09-21","sourceUpdated":"2026-09-21T17:17:34.720","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-36468","references":[{"url":"https://github.com/CuteNews/cutenews-2.0","label":"cve@mitre.org"},{"url":"https://github.com/UmbraDeorum/cutenews-2.0-CVEs-2026-Disclosure","label":"cve@mitre.org"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-21T16:22:38.838042Z"},"ingestedAt":"2026-09-21T16:11:47.453Z","slug":"CVE-2026-36468","body":"## Overview\n\nCross-site Scripting (XSS) in index.php in CuteNews v.2.1.2 allows remote unauthenticated attackers to supply an arbitrarily named URL parameter key, with part of its name containing any URL-encoded common XSS payload (such as \"><script>alert(1)</script>).\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":33.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":208637,"id":"CVE-2026-36468","ts":1790013047533,"field":"cvss","old":null,"new":"6.1"},{"seq":208636,"id":"CVE-2026-36468","ts":1790013047533,"field":"severity","old":"none","new":"medium"}]}