CVE-2026-37107

A vulnerability exists in HTMLy v.3.1.1 within the admin.php component. A remote attacker can exploit the get_feed function to perform a privilege escalation . No specific remediation, exploit links, or MITRE ATT&CK IDs are provided in the documents.

CVE-2026-57940

CVE-2026-57940 affects HTMLy 3.1.1 and describes an SSRF in the RSS feed import. The vulnerable code path is get_feed() in system/admin/admin.php, which passes user-supplied feed_url directly to file_get_contents() without validation. An authenticated admin can exploit this by supplying a crafted...

CVE-2026-57940: Server-Side Request Forgery (SSRF)

HTMLy 3.1.1 contains a Server-Side Request Forgery SSRF vulnerability in the RSS feed import functionality. The function getfeed in system/admin/admin.php passes user-supplied $feedurl directly to filegetcontents without any validation. An authenticated attacker with administrative privileges can...