Cross-site Scripting (XSS) in index.php in CuteNews v.2.1.2 allows remote unauthenticated attackers to supply an arbitrarily named URL parameter key, with part of its name containing any URL-encoded common XSS payload (such as "><script>alert(1)</script>).

Deserialization of Untrusted Data of the postdata parameter in cnparseurl() in CuteNews v.2.1.2 allows a remote attacker to inject arbitrary values into internal request variables (including referer) via a crafted base64-encoded serialized PHP payload submitted as a POST parameter.

Unrestricted Upload of File with Dangerous Type in core/modules/media.php in CuteNews v.2.1.2 allows remote authenticated users with access to the Media Manager panel to execute arbitrary code in the context of the web application, leading to remote server access by triggering a reverse shell.