CuteNews CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM CuteNews CVE published 2026-09-21

CVE-2026-36471

A deserialization of untrusted data vulnerability exists in CuteNews v2.1.2. The __post_data parameter in cn_parse_url() allows a remote attacker to inject arbitrary values into internal request variables via a crafted base64-encoded serialized PHP payload submitted as a POST parameter. This vulnerability can lead to potential injection of arbitrary values into internal request variables, possible disrupt [truncated]