CVE-2026-36471 Details
Description
Deserialization of Untrusted Data of the __post_data parameter in cn_parse_url() in CuteNews v.2.1.2 allows a remote attacker to inject arbitrary values into internal request variables (including __referer) via a crafted base64-encoded serialized PHP payload submitted as a POST parameter.
A vulnerability in CuteNews version 2.1.2 has been identified, allowing remote attackers to exploit insecure deserialization of the `__post_data` parameter. This vulnerability enables the injection of arbitrary values into internal request variables, including the `__referer` variable, by submitting a crafted base64-encoded serialized PHP payload as a POST parameter. The issue arises in the `cn_parse_url()` function within the core module.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 21, 2026CISA-ADP
Assessed Sep 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/CuteNews/cutenews-2.0 | [email protected] | Vendor |
| https://github.com/CuteNews/cutenews-2.0/blob/master/core/core.php | [email protected] | Source CodeVendor |
| https://github.com/UmbraDeorum/cutenews-2.0-CVEs-2026-Disclosure | [email protected] | BundleTechnical Description |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-502 | Deserialization of Untrusted Data | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| CuteNews | 2.1.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 25, 2026 | CVE Modified | CISA-ADP |
| Sep 21, 2026 | New CVE Received | [email protected] |