CVE-2026-37107

An issue in HTMLy v.3.1.1 allows a remote attacker to escalate privileges via the getfeed function in the admin.php component...

CVE-2026-37107

An issue in HTMLy v.3.1.1 allows a remote attacker to escalate privileges via the getfeed function in the admin.php component...

CVE-2026-37107

An issue in HTMLy v.3.1.1 allows a remote attacker to escalate privileges via the get_feed function in the admin.php component. The vulnerability is associated with CWE-269 (Improper Privilege Management) and carries a CRITICAL CVSS 3.1 base score of 9.8. Specific exploit details or remediation i...

CVE-2026-37107

An issue in HTMLy v.3.1.1 allows a remote attacker to escalate privileges via the getfeed function in the admin.php component...

CVE-2026-57940

CVE-2026-57940 affects HTMLy 3.1.1 and describes an SSRF in the RSS feed import. The vulnerable code path is get_feed() in system/admin/admin.php, which passes user-supplied feed_url directly to file_get_contents() without validation. An authenticated admin can exploit this by supplying a crafted...

CVE-2026-57940: Server-Side Request Forgery (SSRF)

HTMLy 3.1.1 contains a Server-Side Request Forgery SSRF vulnerability in the RSS feed import functionality. The function getfeed in system/admin/admin.php passes user-supplied $feedurl directly to filegetcontents without any validation. An authenticated attacker with administrative privileges can...