What is GHSA-29r2-83fr-44fv?

GHSA-29r2-83fr-44fv is a security advisory published by GitHub Security Advisories with Medium severity. CuteNews v.2.1.2 is vulnerable to Cross Site Scripting (XSS) in index.php. The value of the ...

Which CVE IDs does GHSA-29r2-83fr-44fv cover?

GHSA-29r2-83fr-44fv covers the following CVE IDs: CVE-2026-36470. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-29r2-83fr-44fv?

GHSA-29r2-83fr-44fv has a CVSS v3 base score of 5.8, published by GitHub Security Advisories.

GHSA-29r2-83fr-44fvMediumCVSS 5.8

CuteNews v.2.1.2 is vulnerable to Cross Site Scripting (XSS) in index.php. The value of the ...

Vendor

GitHub Security Advisories

Published

September 21, 2026

Last Modified

September 22, 2026

🔗 CVE IDs covered (1)

CVE-2026-36470 →

📋 Description

CuteNews v.2.1.2 is vulnerable to Cross Site Scripting (XSS) in index.php. The value of the "Referer" header is copied into the response HTML unmodified/unescaped during POST messages to index.php.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-36470
https://github.com/CuteNews/cutenews-2.0
https://github.com/UmbraDeorum/cutenews-2.0-CVEs-2026-Disclosure
https://github.com/advisories/GHSA-29r2-83fr-44fv