NPM: Ghost: Remote Code Execution via Bookmark Card Images

NPM: Ghost: Remote Code Execution via Bookmark Card Images vulnerability discovered by ? in WordPress Npm ghost versions = 6.56.0, 6.67.0...

GHSA-788W-68H3-CVXP Ghost: Remote Code Execution via Bookmark Card Images

Impact An image processing library bundled with Ghost contained a vulnerability in its SVG handling. Any staff user, including Contributors, could create a bookmark card for an attacker-controlled website, resulting in arbitrary commands being run on the Ghost server. Vulnerable versions This...

NPM: Ghost: Server-Side Request Forgery in Bookmark Fetching

NPM: Ghost: Server-Side Request Forgery in Bookmark Fetching vulnerability discovered by ? in WordPress Npm ghost versions = 6.54.1, 6.65.0...

EUVD-2026-92761

Ghost: Stored XSS via Bookmark Card Images...

NPM: Ghost: Stored XSS via Bookmark Card Images

NPM: Ghost: Stored XSS via Bookmark Card Images vulnerability discovered by ? in WordPress Npm ghost versions = 5.94.0, 6.64.0...

WordPress CBX Bookmark & Favorite Plugin <= 2.0.4 - SQL Injection

CBX Bookmark & Favorite WordPress plugin = 2.0.4 contains a SQL injection caused by insufficient escaping of the 'orderby' parameter, letting authenticated attackers with Subscriber-level access extract sensitive database information id: CVE-2025-13652 info: name: WordPress CBX Bookmark & Favorit...

SiYuan <= v3.6.1 - Bookmark Data Disclosure

SiYuan v3.6.2 contains an information disclosure vulnerability caused by improper authorization checks in the publish service's bookmark filtering, letting unauthenticated visitors access bookmarked blocks from password-protected documents, exploit requires access to the publish service. id:...

CVE-2026-105651

Ghost is a Node.js content management system. From 5.94.0 until 6.64.0, when creating a bookmark card, Ghost could store non-image files fetched from an external website as bookmark icons or thumbnails. This allowed any staff user, including Contributors, to host arbitrary HTML on the site's...

CVE-2026-105651 Ghost: Stored XSS via Bookmark Card Images

Ghost is a Node.js content management system. From 5.94.0 until 6.64.0, when creating a bookmark card, Ghost could store non-image files fetched from an external website as bookmark icons or thumbnails. This allowed any staff user, including Contributors, to host arbitrary HTML on the site's...

CVE-2026-105651 Ghost: Stored XSS via Bookmark Card Images

Ghost is a Node.js content management system. From 5.94.0 until 6.64.0, when creating a bookmark card, Ghost could store non-image files fetched from an external website as bookmark icons or thumbnails. This allowed any staff user, including Contributors, to host arbitrary HTML on the site's...

CVE-2026-105651

The Ghost Node.js content management system (versions 5.94.0 through 6.64.0 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. When creating a bookmark card, the system could fetch and store non-image files from external websites as icons or thumbnails. This allowed staff users, includi...

CVE-2026-105642 Ghost: Remote Code Execution via Bookmark Card Images

Ghost is a Node.js content management system. From 6.56.0 until 6.67.0, an image processing library bundled with Ghost contained a vulnerability in its SVG handling. Any staff user, including Contributors, could create a bookmark card for an attacker-controlled website, resulting in arbitrary...

CVE-2026-105642 Ghost: Remote Code Execution via Bookmark Card Images

Ghost is a Node.js content management system. From 6.56.0 until 6.67.0, an image processing library bundled with Ghost contained a vulnerability in its SVG handling. Any staff user, including Contributors, could create a bookmark card for an attacker-controlled website, resulting in arbitrary...

CVE-2026-105642

The Ghost Node.js content management system is vulnerable to Remote Code Execution (RCE) in versions 6.56.0 through 6.67.0 . The root cause is a vulnerability in the SVG handling of an image processing library bundled with the software. A staff user, such as a Contributor , can trigger this by cr...

CVE-2026-105642 Ghost: Remote Code Execution via Bookmark Card Images

Ghost is a Node.js content management system. From 6.56.0 until 6.67.0, an image processing library bundled with Ghost contained a vulnerability in its SVG handling. Any staff user, including Contributors, could create a bookmark card for an attacker-controlled website, resulting in arbitrary...

CVE-2026-105642: Improper Control of Generation of Code

Ghost is a Node.js content management system. From 6.56.0 until 6.67.0, an image processing library bundled with Ghost contained a vulnerability in its SVG handling. Any staff user, including Contributors, could create a bookmark card for an attacker-controlled website, resulting in arbitrary...

CVE-2026-105651: Improper Neutralization of Input During Web Page Generation

Ghost is a Node.js content management system. From 5.94.0 until 6.64.0, when creating a bookmark card, Ghost could store non-image files fetched from an external website as bookmark icons or thumbnails. This allowed any staff user, including Contributors, to host arbitrary HTML on the site's...

PT-2026-106185

Name of the Vulnerable Software and Affected Versions Ghost versions 5.94.0 through 6.63.0 Description Ghost, a Node.js content management system, allows staff users, including those with Contributor roles, to host arbitrary HTML on the site domain. This occurs when creating a bookmark card, as t...

CVE-2026-104413

Ghost from 5.94.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users, including Contributors, to host arbitrary HTML by abusing bookmark card image fetching. Attackers can create bookmark cards that store non-image files from external websites as icons or...

CVE-2026-104413

Ghost versions 5.94.0 before 6.64.0 are vulnerable to a stored cross-site scripting (XSS) vulnerability. This flaw occurs when the application allows staff users, including Contributors, to host arbitrary HTML by abusing the bookmark card image fetching mechanism. An attacker can create bookmark ...