CuteNews v.2.1.2 copies the value of the Referer header into the response HTML without escaping during POST requests to index.php. This allows an attacker to inject arbitrary JavaScript that will run in the browsers of any users who view the affected page. Such injected scripts can hijack session cookies, perform malicious actions on behalf of users, or otherwise compromise the integrity and confidentiality of the site.

CuteNews version 2.1.2 is the affected product. The index.php script processing POST requests is the source of the vulnerability.

An attacker can trigger the flaw by sending a crafted HTTP POST with a malicious Referer header to index.php. The payload is reflected directly into the page, so a user who loads the page will have the script executed. No CVSS or EPSS data are available, but XSS gives high risk to confidentiality and integrity. The CISA KEV catalog does not list this issue, and exploit probability information is not provided.