CVE-2026-36471: Security vulnerability
Deserialization of Untrusted Data of the postdata parameter in cnparseurl() in CuteNews v.2.1.2 allows a remote attacker to inject arbitrary values into internal request variables (including referer) via a crafted base64-encoded serialized PHP payload submitted as a POST parameter.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker needs the ability to send a POST request containing a crafted base64-encoded serialized PHP payload in the __post_data parameter. The issue is described as remotely exploitable.
What can an attacker change through successful exploitation?
A successful payload can inject arbitrary values into internal request variables. The affected variables include __referer.
Are default installations affected?
The available data identifies CuteNews v.2.1.2 as affected, but it does not state whether the vulnerable behavior is enabled or reachable in a default installation.