CVE-2026-92380

A flaw has been found in WuzhiCMS up to 4.1.0. The impacted element is the function ckditor::saveRemote of the file coreframe/app/attachment/index.php of the component Remote Image Fetch. This manipulation of the argument source causes server-side request forgery. The attack can be initiated...

CVE-2026-92380 WuzhiCMS Remote Image Fetch index.php saveRemote server-side request forgery

A flaw has been found in WuzhiCMS up to 4.1.0. The impacted element is the function ckditor::saveRemote of the file coreframe/app/attachment/index.php of the component Remote Image Fetch. This manipulation of the argument source causes server-side request forgery. The attack can be initiated...

CVE-2026-92380

WuzhiCMS up to 4.1.0 is affected by a server-side request forgery (SSRF) vulnerability in the Remote Image Fetch component. The flaw resides in the function ckditor::saveRemote within coreframe/app/attachment/index.php , where manipulation of the source[] argument allows an unauthenticated, remot...

EUVD-2026-80792

A flaw has been found in WuzhiCMS up to 4.1.0. The impacted element is the function ckditor::saveRemote of the file coreframe/app/attachment/index.php of the component Remote Image Fetch. This manipulation of the argument source causes server-side request forgery. The attack can be initiated...

CVE-2026-76552

The WP Import Export Lite WordPress plugin before version 3.9.33 contains an authenticated arbitrary file upload vulnerability. The plugin does not validate the type, extension, or content of files retrieved from a user-supplied URL during import, allowing any user granted the import permission t...

CVE-2026-76552 WP Import Export Lite < 3.9.33 - Authenticated Arbitrary File Upload via Remote Image Import

The WP Import Export Lite WordPress plugin before 3.9.33 does not validate the type, extension or content of files it retrieves from a user-supplied URL during import, allowing users granted its import permission to store arbitrary files, including executable ones, on the server and achieve remot...

next_js_poisoning

CVE-2024-4698 — это уязвимость отравления кэша в Next.js, которая затрагивает версии с 13.5.1 по 13.5.7, а также с 14.0.0 по 14.2.10. Проблема возникает, когда веб-сайты используют API next/image?url= с параметром ?url=, что позволяет злоумышленникам загружать изображения, размещённые на их...

CVE-2026-45806

CVE-2026-45806 Импорт удаленных изображений в Penpot позволял аутентифицированному редактору файлов превратить обычную функцию работы с медиа в SSRF из бэкенда, поскольку управляемые атакующим URL попадали в путь выборки с сервера, который следовал перенаправлениям без фильтрации целевых адресов...

CVE-2026-49865

Kimai is an open-source time tracking application. Versions prior to 2.58.0 contain a server-side request forgery vulnerability in their invoice PDF preview and generation workflow. If an attacker can control Markdown content that is later rendered into an invoice PDF, such as Customer.invoiceTex...

CVE-2026-49865

Kimai , an open-source time tracking application, versions prior to 2.58.0 are affected by a Server-Side Request Forgery (SSRF) in the invoice PDF preview and generation workflow. The root cause is that user-controlled Markdown fields (e.g., Customer.invoiceText) pass through an md2html filter in...

CVE-2026-65842

Plate is a rich-text editor with AI and shadcn/ui. Prior to 53.3.2, @platejs/docx-io fetches remote image URLs while converting attacker-controlled HTML through htmlToDocxBlob in a server-side or privileged environment. The converter can make requests to internal network resources and include the...

CVE-2026-75003

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, an unclosed url in a FuncIRI attribute of an SVG image could evade the remote image blocking, which may lead to information disclosure or privilege escalation...

CVE-2026-75000

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the SVG animate "by" attribute may lead to remote image blocking bypass, which in turn may lead to information disclosure or privilege escalation...

CVE-2026-75003

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, an unclosed url in a FuncIRI attribute of an SVG image could evade the remote image blocking, which may lead to information disclosure or privilege escalation...

CVE-2026-75003

CVE-2026-75003 affects Roundcube Webmail versions before 1.6.18 and 1.7.x before 1.7.3 . Discovered by Milan Hoppe , the root cause is insufficient HTML/CSS sanitization of an unclosed url() in a FuncIRI attribute of an SVG image embedded in text/html emails. This allows evasion of the remote ima...

PT-2026-76643

Name of the Vulnerable Software and Affected Versions Roundcube Webmail versions prior to 1.6.18 Roundcube Webmail versions 1.7.x prior to 1.7.3 Description An unclosed url in a FuncIRI attribute of an SVG image allows the evasion of remote image blocking. This flaw could potentially lead to...

CVE-2026-64644

Next.js is a React framework for building full-stack web applications. In versions 15.5.0 through 15.5.20 and 16.0.0 through 16.2.10, when self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely hosted images if configured not enabled by default. If...

CVE-2026-64799

CVE-2026-64799 affects Joomla extensions from Regular Labs (Articles Anywhere and Users Anywhere). The issue is SSRF via remote image downloads where content-controlled image URLs can touch private or reserved network services, follow unsafe redirects, and save responses without validating they a...

CVE-2026-64799 Joomla Extension - regularlabs.com - SSRF via remote image downloads in Articles Anywhere and Users Anywhere extensions

Joomla Extension - regularlabs.com - SSRF via remote image downloads in Articles Anywhere and Users Anywhere extensions - Content-controlled image URLs could request private or reserved network services, follow unsafe redirects and save responses without validating that they were images. This cou...

CVE-2026-45806 Penpot: Authenticated SSRF in remote image import via create-file-media-object-from-url

Penpot is an open-source design tool for design and code collaboration. Prior to 2.15.0, Penpot's remote image import passed the user-controlled url from frontend/src/app/main/data/workspace/media.cljs into the backend RPC method :create-file-media-object-from-url in...