EIP-2026-106306

This exploit targets CuteNews <= 1.4.6 by leveraging an authenticated privilege escalation vulnerability in the IP ban feature to inject PHP code into ipban.db.php, enabling remote command execution. The PoC includes a reverse shell payload and interactive shell functionality.