CVE-2026-36471

CuteNews v.2.1.2 is vulnerable to Deserialization of Untrusted Data in the cn_parse_url() function. A remote attacker can submit a crafted base64-encoded serialized PHP payload as the __post_data POST parameter, allowing injection of arbitrary values into internal request variables (including __r...