rootpwn

critical · CVSS v3 9.8

CVE-2026-36471

CuteNews v.2.1.2 is vulnerable to deserialization of untrusted data via the __post_data parameter in cn_parse_url(), allowing a remote attac

Overview

CuteNews v.2.1.2 is vulnerable to deserialization of untrusted data via the __post_data parameter in cn_parse_url(), allowing a remote attacker to inject arbitrary values into internal request variables, including __referer. This flaw can lead to unauthorized data manipulation or potential remote code execution. The vulnerability is critical with a CVSS v3 score of 9.8.

Description

Deserialization of Untrusted Data of the __post_data parameter in cn_parse_url() in CuteNews v.2.1.2 allows a remote attacker to inject arbitrary values into internal request variables (including __referer) via a crafted base64-encoded serialized PHP payload submitted as a POST parameter.

Impact

The flaw compromises confidentiality, integrity, and availability of the application by allowing attackers to alter request variables and potentially execute arbitrary code. Administrators and end‑users are at risk of data tampering, session hijacking, and service disruption.

Remediation

Apply the vendor‑issued patch or upgrade to the latest CuteNews release. If an update is not immediately possible, disable or sanitize the __post_data parameter, enforce strict input validation, and avoid unserializing untrusted data. Monitor logs for suspicious POST activity and consider implementing a Web Application Firewall rule to block malformed requests.

Risk context

The vulnerability is rated critical with a CVSS v3 score of 9.8, indicating a high urgency for remediation. No EPSS data is available, but the severity alone warrants immediate attention.

Affected products

  • CuteNews 2.1.2

Scores

Severity
critical
CVSS v2
7.5
CVSS v3
9.8
CVSS v4
—
EPSS
—

deserialization remote-code-execution CuteNews critical php input-validation

← All CVEs

Related CVEs

critical

CVE-2026-88854

The vulnerability is an unauthenticated SQL injection in the OrdaSoft Joomla Gallery extension’s search endpoint. It allows attackers to execute arbitrary SQL queries and exfiltrate database contents without authentication. The flaw exists because the getVar() method is not properly sanitized.

View analysis

critical

CVE-2026-53940

Conda is a system-level binary package and environment manager that runs on major operating systems and platforms. Prior to 26.5.2, parse_entry_point_def in conda/common/path/python.py accepted an unvalidated entry-point command from a noarch:python package's info/link.json metadata. CreatePythonEntryPointAction in conda/core/path_actions.py interpolated that command into target_short_path, and PrefixPathAction.target_full_path joined it to the installation prefix without verifying that the result remained under the intended bin or Scripts directory. create_python_entry_point in conda/gateways/disk/create.py then wrote an executable wrapper to the resulting path. A malicious package could use path separators, traversal segments, or an absolute command path to write outside the prefix or overwrite another in-prefix entry point during default install and environment transactions. Out-of-prefix writes require the target parent directory to exist, while an overwritten entry point can execute attacker-controlled Python when later invoked with the installing user's privileges. This issue is fixed in version 26.5.2.

View analysis

critical

CVE-2026-82412

ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, the vulnerability-scan endpoints scripts/lua/rest/v2/add/host/to_scan.lua and scripts/lua/rest/v2/exec/host/schedule_vulnerability_scan.lua accept the scan_ports parameter without an administrator gate and pass it through validateSingleWord, which permits shell metacharacters. scripts/lua/modules/vulnerability_scan/vs_utils.lua then concatenates scan_ports into an nmap command in nmap_scan_host and executes the command through ntop.execCmd or ntop.execCmdAsync and popen. Any authenticated non-admin user can execute operating-system commands as the ntopng process account when nmap is available. Because the endpoints accept GET requests while ntopng's CSRF validation applies to POST request bodies, an attacker can also trigger the command through a logged-in user's browser without possessing ntopng credentials. This issue is fixed in version 6.7.260717.

View analysis

critical

CVE-2026-85751

Mailu is a mail server distributed as a set of Docker images. From Mailu 2.0 until 2024.06.55 and prior to Mailu helm-charts 2.7.3, deployments with PROXY_AUTH_WHITELIST configured but REAL_IP_HEADER unset trusted a client-controlled X-Forwarded-By header for header-based proxy authentication. The proxy_hide_header directive in the nginx template at core/nginx/conf/proxy.conf hid the header from upstream responses but did not overwrite the incoming request value in this configuration. An unauthenticated remote attacker could therefore spoof the trusted proxy identity and bypass authentication. This issue is fixed in Mailu 2024.06.55 and Mailu helm-charts 2.7.3.

View analysis