Cutenews 2.1.2 Exploit -

Prior to authentication, an attacker can leverage the action parameter handling in core/modules.php .