CVE-2026-37107

An issue in HTMLy v.3.1.1 allows a remote attacker to escalate privileges via the getfeed function in the admin.php component...

EUVD-2026-99005

An issue in HTMLy v.3.1.1 allows a remote attacker to escalate privileges via the getfeed function in the admin.php component...

CVE-2026-37107

An issue in HTMLy v.3.1.1 allows a remote attacker to escalate privileges via the getfeed function in the admin.php component...

CVE-2026-37107

An issue in HTMLy v.3.1.1 allows a remote attacker to escalate privileges via the getfeed function in the admin.php component...

CVE-2026-37107

An issue in HTMLy v.3.1.1 allows a remote attacker to escalate privileges via the getfeed function in the admin.php component...

CVE-2026-37107: Improper Privilege Management

An issue in HTMLy v.3.1.1 allows a remote attacker to escalate privileges via the getfeed function in the admin.php component...

CVE-2026-37107

An issue in HTMLy v.3.1.1 allows a remote attacker to escalate privileges via the getfeed function in the admin.php component...

CVE-2026-37107

An issue in HTMLy v.3.1.1 allows a remote attacker to escalate privileges via the get_feed function in the admin.php component. The vulnerability is associated with CWE-269 (Improper Privilege Management) and carries a CRITICAL CVSS 3.1 base score of 9.8. Specific exploit details or remediation i...

Dan HTML Security Vulnerability

A security vulnerability exists in HTMLy version 3.1.1. It stems from issues in the getfeed function within the admin.php component, potentially allowing remote attackers to escalate privileges...

CVE-2026-57940

CVE-2026-57940 affects HTMLy 3.1.1 and describes an SSRF in the RSS feed import. The vulnerable code path is get_feed() in system/admin/admin.php, which passes user-supplied feed_url directly to file_get_contents() without validation. An authenticated admin can exploit this by supplying a crafted...

CVE-2026-57940

HTMLy 3.1.1 contains a Server-Side Request Forgery SSRF vulnerability in the RSS feed import functionality. The function getfeed in system/admin/admin.php passes user-supplied $feedurl directly to filegetcontents without any validation. An authenticated attacker with administrative privileges can...

CVE-2026-57940: Server-Side Request Forgery (SSRF)

HTMLy 3.1.1 contains a Server-Side Request Forgery SSRF vulnerability in the RSS feed import functionality. The function getfeed in system/admin/admin.php passes user-supplied $feedurl directly to filegetcontents without any validation. An authenticated attacker with administrative privileges can...