What is GHSA-mwgw-rr28-m856?

GHSA-mwgw-rr28-m856 is a security advisory published by GitHub Security Advisories with Medium severity. Deserialization of Untrusted Data of the __post_data parameter in cn_parse_url() in CuteNews v.2...

Which CVE IDs does GHSA-mwgw-rr28-m856 cover?

GHSA-mwgw-rr28-m856 covers the following CVE IDs: CVE-2026-36471. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-mwgw-rr28-m856?

GHSA-mwgw-rr28-m856 has a CVSS v3 base score of 5.8, published by GitHub Security Advisories.

GHSA-mwgw-rr28-m856MediumCVSS 5.8

Deserialization of Untrusted Data of the __post_data parameter in cn_parse_url() in CuteNews v.2...

Vendor

GitHub Security Advisories

Published

September 21, 2026

Last Modified

September 25, 2026

🔗 CVE IDs covered (1)

CVE-2026-36471 →

📋 Description

Deserialization of Untrusted Data of the __post_data parameter in cn_parse_url() in CuteNews v.2.1.2 allows a remote attacker to inject arbitrary values into internal request variables (including __referer) via a crafted base64-encoded serialized PHP payload submitted as a POST parameter.

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2026-36471
https://github.com/CuteNews/cutenews-2.0
https://github.com/CuteNews/cutenews-2.0/blob/master/core/core.php
https://github.com/UmbraDeorum/cutenews-2.0-CVEs-2026-Disclosure
https://github.com/advisories/GHSA-mwgw-rr28-m856