The flaw lies in an improper neutralization of the __referer field, allowing a remote attacker to embed a javascript: URI that renders as an unsanitized clickable link on the msg_info page. When an authenticated user visits the link, the embedded script runs with the privileges of that user, enabling execution of arbitrary code in the victim’s browser.

CuteNews version 2.1.2 is affected. The vulnerability exists in the core handling of the __referer value and is triggered when a crafted message containing a javascript: link is displayed on the msg_info page.

The exploit requires a user with an authenticated session to access the injected link, which can be triggered by a remote attacker sending a malicious message or embedding the payload in an external site that renders the message. While no EPSS score is available and the vulnerability is not listed in CISA KEV, the vulnerability enables execution of arbitrary code in the victim’s browser. The CVSS score of 5.2 indicates a moderate severity. The attack vector is inferred to be remote via crafted web content; the condition is that the target user remains authenticated and views the msg_info page.