CVE-2026-18856 Poesis Rhymix CMS Data Import importer.admin.controller.php procImporterAdminCheckXmlFile server-side request forgery

A vulnerability was determined in Poesis Rhymix CMS up to 2.1.33. This impacts the function procImporterAdminCheckXmlFile of the file modules/importer/importer.admin.controller.php of the component Data Import Module. This manipulation of the argument filename causes server-side request forgery...

CVE-2026-18856 Poesis Rhymix CMS Data Import importer.admin.controller.php procImporterAdminCheckXmlFile server-side request forgery

A vulnerability was determined in Poesis Rhymix CMS up to 2.1.33. This impacts the function procImporterAdminCheckXmlFile of the file modules/importer/importer.admin.controller.php of the component Data Import Module. This manipulation of the argument filename causes server-side request forgery...

EUVD-2026-53015

A vulnerability was determined in Poesis Rhymix CMS up to 2.1.33. This impacts the function procImporterAdminCheckXmlFile of the file modules/importer/importer.admin.controller.php of the component Data Import Module. This manipulation of the argument filename causes server-side request forgery...

PT-2026-68021

Name of the Vulnerable Software and Affected Versions Pluck CMS versions prior to 4.7.22 Description The admin file-management feature fails to properly restrict dangerous file uploads. The system uses a fixed blacklist in data/inc/files.php that checks the last 4-5 characters of a filename but...

PT-2026-68011

Name of the Vulnerable Software and Affected Versions HashBrown CMS versions prior to 1.4.7 Description The Git deployer component contains an OS Command Injection flaw. The pullRepo function in src/Server/Entity/Deployer/GitDeployer.js uses AppService.exec to run a shell command that interpolate...

PT-2026-68036

Name of the Vulnerable Software and Affected Versions Pluck CMS affected versions not specified Description The admin panel lacks per-request anti-CSRF tokens and relies exclusively on a Referer-header comparison within the requestedByTheSameDomain function located in data/inc/functions.admin.php...

PT-2026-68010

Name of the Vulnerable Software and Affected Versions HashBrown CMS versions prior to 1.4.7 Description An OS Command Injection issue exists in the media upload thumbnail generation routine. The Media.generateThumbnail function in src/Server/Entity/Resource/Media.js creates a temporary file path...

CVE-2026-70376: Cross-Site Request Forgery (CSRF)

Pluck CMS's admin panel relies solely on a Referer-header comparison requestedByTheSameDomain in data/inc/functions.admin.php, gating every admin.php action for CSRF protection, with no per-request anti-CSRF token anywhere in the admin area...

CVE-2026-71292: Improper Neutralization of Special Elements used in an SQL Command

Subrion CMS's admin grid sorting helper, gridGetSorting in includes/classes/ia.base.controller.admin.php, whitelists the ASC/DESC request parameter via inarray, but falls back to the raw, attacker-supplied GET parameter whenever the requested key is not present in the per-controller whitelist...

CVE-2026-54416: Unrestricted Upload of File with Dangerous Type

Pluck CMS through 4.7.21 restricts dangerous file uploads in its admin file-management feature using a fixed blacklist in data/inc/files.php '.php','php3','php4','php5','php6','php7','phtml','.phtm','.pht','.ph3','.ph4','.ph5','.asp','.cgi','.phar', checked against the last 4-5 characters of the...

PT-2026-68163

Name of the Vulnerable Software and Affected Versions Bolt CMS affected versions not specified Description Bolt CMS renders content field values using the full Twig application-level Environment without a SandboxExtension. In the src/Entity/Field.php file, the getTwigValue function calls...

CVE-2026-71293: Exposure of Sensitive Information to an Unauthorized Actor

Statamic CMS's user-augmentation resolver, AugmentedUser::get in src/Auth/AugmentedUser.php, contains an explicit case for the handle that returns the user's raw two-factor recovery codes with no access restriction...

CVE-2026-70375: Improper Neutralization of Special Elements used in an OS Command

HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability CWE-78 in the Git deployer component. GitDeployer.pullRepo in src/Server/Entity/Deployer/GitDeployer.js executes AppService.exec, interpolating the configured branch value directly into a shell command with no escaping...

CVE-2026-70374: Improper Neutralization of Special Elements used in an OS Command

HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability CWE-78 in the media upload thumbnail generation routine. Media.generateThumbnail in src/Server/Entity/Resource/Media.js builds a temporary file path as 'thumbnail' + Path.extnamefilename and passes it, unescaped, into a...

CVE-2026-18856: Server-Side Request Forgery (SSRF)

A vulnerability was determined in Poesis Rhymix CMS up to 2.1.33. This impacts the function procImporterAdminCheckXmlFile of the file modules/importer/importer.admin.controller.php of the component Data Import Module. This manipulation of the argument filename causes server-side request forgery...

PT-2026-68166

Name of the Vulnerable Software and Affected Versions Cotonti CMS affected versions not specified Description The Comments plugin in Cotonti CMS fails to restrict classes during the deserialization of user-supplied data, leading to a PHP Object Injection. This occurs when the unserialize function...

PT-2026-68164

Name of the Vulnerable Software and Affected Versions Subrion CMS affected versions not specified Description The admin grid sorting helper gridGetSorting in includes/classes/ia.base.controller.admin.php fails to properly validate the sort GET parameter. While the function attempts to whitelist t...

PT-2026-67898

Name of the Vulnerable Software and Affected Versions Poesis Rhymix CMS versions prior to 2.1.34 Description An issue exists in the Data Import Module within the procImporterAdminCheckXmlFile function of the modules/importer/importer.admin.controller.php file. Remote manipulation of the filename...

PT-2026-68165

Name of the Vulnerable Software and Affected Versions Statamic CMS affected versions not specified Description The user-augmentation resolver AugmentedUser::get in src/Auth/AugmentedUser.php contains a case for the two factor recovery codes handle that returns raw two-factor recovery codes withou...

CVE-2026-71294: Deserialization of Untrusted Data

Cotonti CMS's Comments plugin deserializes user-supplied data without restricting the classes that may be instantiated. In plugins/comments/controllers/actions/CreateAction.php, a POST parameter obtained via trim-only sanitization is passed to with no restriction, reachable by any member with wri...