CVE-2026-36471

Deserialization of Untrusted Data of the postdata parameter in cnparseurl in CuteNews v.2.1.2 allows a remote attacker to inject arbitrary values into internal request variables including referer via a crafted base64-encoded serialized PHP payload submitted as a POST parameter...

CVE-2026-36471

CuteNews v.2.1.2 is vulnerable to Deserialization of Untrusted Data in the cn_parse_url() function. A remote attacker can submit a crafted base64-encoded serialized PHP payload as the __post_data POST parameter, allowing injection of arbitrary values into internal request variables (including __r...