CVE-2026-85612 OpenPanel before 2.3.0 SSRF via favicon and og endpoints

OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerability in the /misc/favicon and /misc/og endpoints that accept an attacker-supplied url parameter with insufficient validation. Attackers can force the API to fetch arbitrary internal hosts and cloud metadata...

CVE-2026-85612 OpenPanel before 2.3.0 SSRF via favicon and og endpoints

OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerability in the /misc/favicon and /misc/og endpoints that accept an attacker-supplied url parameter with insufficient validation. Attackers can force the API to fetch arbitrary internal hosts and cloud metadata...

EUVD-2026-71032

OpenPanel before 2.3.0 contains a cross-site scripting vulnerability in the unauthenticated favicon proxy endpoint GET /misc/favicon that allows remote attackers to execute scripts by supplying an SVG file URL. Attackers can host malicious SVG files with embedded scripts that execute in the...

CVE-2026-85612

OpenPanel before 2.3.0 contains an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in the /misc/favicon and /misc/og endpoints. These endpoints accept an attacker-supplied url parameter with insufficient validation, allowing an attacker to force the API to fetch arbitrary interna...

Miniflux: cross-user favicon read via icon ID enumeration (horizontal privilege information disclosure)

Miniflux Icon Endpoint Cross-User Unauthorized Favicon Read Vulnerability Overview The Miniflux v2 REST API endpoint that fetches a favicon by icon ID queries solely on the icon's globally unique numeric identifier within the instance, without performing any association check between the icon and...

PT-2025-34508 · WordPress · Wc Plus

Name of the Vulnerable Software and Affected Versions: WC Plus plugin for WordPress versions up to and including 1.2.0 Description: The WC Plus plugin for WordPress is susceptible to unauthorized data modification. This is due to a missing capability check on the pluswc logo favicon logo base API...

Appwrite 代码问题漏洞

Appwrite is Appwrite open source an end-to-end backend server . Used to package into a set of Docker microservices for web, mobile, native or backend applications. A security vulnerability exists in Appwrite v1.2.1 and earlier versions , which stems from the discovery of a contained server-side...