CVE-2026-48707

InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Server-Side Request Forgery SSRF vulnerability in the file upload functionality system/core/uploader.php at lines 509-532. When the "upload from URL" feature follows an HTTP redirect, the redirected...

EUVD-2026-73924

InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Server-Side Request Forgery SSRF vulnerability in the file upload functionality system/core/uploader.php at lines 509-532. When the "upload from URL" feature follows an HTTP redirect, the redirected...

CVE-2026-48707 InstantCMS vulnerable to SSRF via upload redirect bypass allows internal network service scanning

InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Server-Side Request Forgery SSRF vulnerability in the file upload functionality system/core/uploader.php at lines 509-532. When the "upload from URL" feature follows an HTTP redirect, the redirected...

PT-2026-87190

InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Server-Side Request Forgery SSRF vulnerability in the file upload functionality system/core/uploader.php at lines 509-532. When the "upload from URL" feature follows an HTTP redirect, the redirected...

EUVD-2026-71796

Camaleon CMS versions 2.7.5 through 2.9.1 fail to validate redirect targets when fetching remote files in the Upload from URL media feature. Authenticated attackers can supply URLs that pass initial validation but redirect to internal network addresses, allowing server-side request forgery to...

CVE-2026-86100

Camaleon CMS versions 2.7.5 through 2.9.1 fail to validate redirect targets when fetching remote files in the Upload from URL media feature. Authenticated attackers can supply URLs that pass initial validation but redirect to internal network addresses, allowing server-side request forgery to...

CVE-2026-86100: Server-Side Request Forgery (SSRF)

Camaleon CMS versions 2.7.5 through 2.9.1 fail to validate redirect targets when fetching remote files in the Upload from URL media feature. Authenticated attackers can supply URLs that pass initial validation but redirect to internal network addresses, allowing server-side request forgery to...

CVE-2026-86100 Camaleon CMS 2.7.5 through 2.9.1 SSRF via HTTP Redirect in Upload from URL

Camaleon CMS versions 2.7.5 through 2.9.1 fail to validate redirect targets when fetching remote files in the Upload from URL media feature. Authenticated attackers can supply URLs that pass initial validation but redirect to internal network addresses, allowing server-side request forgery to...

CVE-2026-86100 Camaleon CMS 2.7.5 through 2.9.1 SSRF via HTTP Redirect in Upload from URL

Camaleon CMS versions 2.7.5 through 2.9.1 fail to validate redirect targets when fetching remote files in the Upload from URL media feature. Authenticated attackers can supply URLs that pass initial validation but redirect to internal network addresses, allowing server-side request forgery to...

CVE-2026-86100

Camaleon CMS versions 2.7.5 through 2.9.1 contain a Server-Side Request Forgery (SSRF) vulnerability in the Upload from URL media feature. The application fails to validate HTTP redirect targets when fetching remote files, allowing an authenticated attacker to supply a URL that passes initial val...

CVE-2026-86100 Camaleon CMS 2.7.5 through 2.9.1 SSRF via HTTP Redirect in Upload from URL

Camaleon CMS versions 2.7.5 through 2.9.1 fail to validate redirect targets when fetching remote files in the Upload from URL media feature. Authenticated attackers can supply URLs that pass initial validation but redirect to internal network addresses, allowing server-side request forgery to...

PT-2026-86269

Camaleon CMS versions 2.7.5 through 2.9.1 fail to validate redirect targets when fetching remote files in the Upload from URL media feature. Authenticated attackers can supply URLs that pass initial validation but redirect to internal network addresses, allowing server-side request forgery to...

CVE-2026-73340

Contributor Cross Site Scripting XSS in Featured Image from URL = 5.3.3 versions...

EUVD-2026-57909

Contributor Cross Site Scripting XSS in Featured Image from URL = 5.3.3 versions...

CVE-2026-73340 WordPress Featured Image from URL plugin <= 5.3.3 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Featured Image from URL = 5.3.3 versions...

CVE-2026-73340

The CVE covers a Cross Site Scripting (XSS) vulnerability in the WordPress plugin Featured Image from URL , affecting versions

CVE-2026-73340 WordPress Featured Image from URL plugin <= 5.3.3 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Featured Image from URL = 5.3.3 versions...

CVE-2026-73340: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Featured Image from URL = 5.3.3 versions...

PT-2026-71599

Contributor Cross Site Scripting XSS in Featured Image from URL = 5.3.3 versions...

WordPress Featured Image from URL plugin <= 5.3.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by luc in WordPress Plugin Featured Image from URL versions = 5.3.3...