EUVD-2026-92782

Feehi CMS 2.1.1 is vulnerable to Directory Traversal. An authenticated backend user with article edit permission can delete arbitrary files writable by the PHP process. Article image metadata is used to construct a filesystem path and is passed to unlink without path traversal or directory...

CVE-2026-95264

Feehi CMS 2.1.1 is vulnerable to a Directory Traversal vulnerability (CWE-22). An authenticated backend user with article edit permissions can delete arbitrary files writable by the PHP process. The root cause is that the application uses article image metadata to construct a filesystem path, whi...

CVE-2026-95263

Feehi CMS 2.1.1 is vulnerable to Incorrect Access Control. A low-privilege backend administrator with administrator-update permission can change the password of the built-in super administrator account. The server does not enforce protection for this account, and the update scenario does not...

Linux Distros Unpatched Vulnerability : CVE-2026-105217

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cockpit CMS 2.12.0 before 2.14.1 disables TLS certificate verification in the cron.php web worker restart request, allowing network attackers to capture the...

CVE-2026-95263

Feehi CMS 2.1.1 is vulnerable to Incorrect Access Control. A low-privilege backend administrator with administrator-update permission can change the password of the built-in super administrator account. The server does not enforce protection for this account, and the update scenario does not...

PT-2026-106005

Name of the Vulnerable Software and Affected Versions Kunstmaan CMS versions prior to 7.3.2 Description An issue exists in the FileHandler::getFilePath function within src/Kunstmaan/MediaBundle/Helper/File/FileHandler.php where the blacklisted extensions check is performed case-sensitively. Becau...

CVE-2026-104890: Unrestricted Upload of File with Dangerous Type

Kunstmaan CMS is an open source content management system based on the Symfony framework. Prior to 7.3.2, src/Kunstmaan/MediaBundle/Helper/File/FileHandler.php performs the blacklistedextensions check case-sensitively in FileHandler::getFilePath and lowercases the stored extension afterward. An...

PT-2026-106224

Name of the Vulnerable Software and Affected Versions Feehi CMS version 2.1.1 Description Incorrect Access Control allows a low-privilege backend administrator with administrator-update permission to change the password of the built-in super administrator account. This occurs because the server...

CVE-2026-95263

Feehi CMS 2.1.1 is vulnerable to Incorrect Access Control (CWE-284). A low-privilege backend administrator possessing administrator-update permissions can modify the password of the built-in super administrator account. This is possible because the server fails to enforce protections for the supe...

CVE-2026-95265

Feehi CMS 2.1.1 contains a Server-Side Request Forgery SSRF vulnerability in the UEditor catchimage endpoint. The private-IP validation does not block loopback or link-local addresses, allowing an attacker to make the server probe internal HTTP services through response differences...

CVE-2026-95265

Feehi CMS 2.1.1 contains a Server-Side Request Forgery SSRF vulnerability in the UEditor catchimage endpoint. The private-IP validation does not block loopback or link-local addresses, allowing an attacker to make the server probe internal HTTP services through response differences...

CVE-2022-26265

CVE-2022-26265 Contao CMS RCE Questo repository fa parte del framework hgrab-framework Prodotto interessato Contao CMS v1.5.0 Installazione Installa l'app sul server user@domain: git clone https://github.com/sh4den/CVE-2022-26265.git user@domain: cd ./CVE-2022-26265/ user@domain: python3 main.py ...

cms-made-simple-python3

CMS Made Simple – Toolkit di Exploit Una raccolta di script, note e exploit pronti per Python3 per CMS Made Simple CMSMS , inclusa la famosa SQL Injection Time-Based non autenticata – CVE-2019-9053. Questo repository è creato e mantenuto da Encrypticle Jagdeep Singh come parte della mia ricerca...

CVE-2026-105217

Cockpit CMS 2.12.0 before 2.14.1 disables TLS certificate verification in the cron.php web worker restart request, allowing network attackers to capture the worker token. Man-in-the-middle attackers on the outbound path to siteurl can present any certificate to steal the worker/web/token value an...

CVE-2026-105217

A flaw was found in Cockpit CMS. The application disables Transport Layer Security TLS certificate verification when making background requests to restart web workers. An attacker in a position to intercept network traffic could exploit this flaw by presenting an arbitrary certificate, allowing...

CVE-2026-105217

The Cockpit CMS (versions 2.12.0 before 2.14.1 ) is vulnerable to a flaw where it disables TLS certificate verification during the cron.php web worker restart request. This allows a man-in-the-middle attacker on the outbound path to the site_url to present a fraudulent certificate and capture the...

EUVD-2026-92120

Cockpit CMS 2.12.0 before 2.14.1 disables TLS certificate verification in the cron.php web worker restart request, allowing network attackers to capture the worker token. Man-in-the-middle attackers on the outbound path to siteurl can present any certificate to steal the worker/web/token value an...

CVE-2026-105217 Cockpit CMS 2.12.0 before 2.14.1 Disabled TLS Verification via cron.php

Cockpit CMS 2.12.0 before 2.14.1 disables TLS certificate verification in the cron.php web worker restart request, allowing network attackers to capture the worker token. Man-in-the-middle attackers on the outbound path to siteurl can present any certificate to steal the worker/web/token value an...

CVE-2026-105217 Cockpit CMS 2.12.0 before 2.14.1 Disabled TLS Verification via cron.php

Cockpit CMS 2.12.0 before 2.14.1 disables TLS certificate verification in the cron.php web worker restart request, allowing network attackers to capture the worker token. Man-in-the-middle attackers on the outbound path to siteurl can present any certificate to steal the worker/web/token value an...

CVE-2026-105217 Cockpit CMS 2.12.0 before 2.14.1 Disabled TLS Verification via cron.php

Cockpit CMS 2.12.0 before 2.14.1 disables TLS certificate verification in the cron.php web worker restart request, allowing network attackers to capture the worker token. Man-in-the-middle attackers on the outbound path to siteurl can present any certificate to steal the worker/web/token value an...