MinorCritical vulnerability
CVE-2026-36467 (CVSS 7.2)
NVD · officialPublished Sep 21, 2026Risk 23/100
Unrestricted Upload of File with Dangerous Type in core/modules/media.php in CuteNews v.2.1.2 allows remote authenticated users with access to the Media Manager panel to execute arbitrary code in the context of the web application, leading to remote server access by triggering a reverse shell.
Technical details
CVSS
7.2
AV:NetworkAC:LowPR:HighUI:NoneC:HighI:HighA:High
Evidence and sources
This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.
Open primary source