CVE-2026-96533 Testimonials Widget <= 4.0.4 - Unauthenticated SSRF via Featured Image URL

The Testimonials Widget WordPress plugin through 4.0.4 does not validate a user-supplied URL before fetching it server-side and storing the response as a public file, allowing unauthenticated users to make the server issue requests to internal services and read the responses...

CVE-2026-63006

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, attacker-controlled HTML in inbound emails or tickets could bypass the image URL sanitizer using path traversal sequences. When an authenticated agent views the content, the browser resolves the URL to a protected...

CVE-2026-56734

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, during federated authentication OAuth/OIDC/SAML, a profile image URL from the external identity provider is fetched without verifying the target address. An actor who controls their profile at a connected provider...

next_js_poisoning

CVE-2024-4698 は、Next.js のキャッシュポイズニング脆弱性であり、バージョン 13.5.1 から 13.5.7、および 14.0.0 から 14.2.10 に影響します。この問題は、Webサイトが next/image?url= API を ?url= パラメータと共に利用する際に発生し、攻撃者が自身のサーバーでホストされている画像を読み込むことが可能になります。これらのカスタム攻撃画像は、攻撃者が Ngrok や Apache サービスを停止した後でも、被害者の Webサイトに永久に保存される可能性があります。 攻撃者は Ngrok のようなトンネリングツールや...

CVE-2025-50738-PoC

CVE-2025-50738 これは非常にシンプルです。SVGを介した格納型XSSは、実環境でクロスサイトスクリプティング（XSS）を見つける非常に一般的な方法なので、最初に試したことの一つでした。 Pikapods経由でusememosをデプロイし、フロントページに移動してアカウントを作成しました。 そのアカウントで「thought」を作成しました： そして、以下のペイロードを含むSVGファイルを作成しました： root@kitploit:...

CVE-2026-49865 Kimai has Server-Side Request Forgery in Invoice PDF Rendering via Markdown Image URLs

Kimai is an open-source time tracking application. Versions prior to 2.58.0 contain a server-side request forgery vulnerability in their invoice PDF preview and generation workflow. If an attacker can control Markdown content that is later rendered into an invoice PDF, such as Customer.invoiceTex...

CVE-2026-86780

The Featured Image with URL WordPress plugin before 1.0.6 does not sanitise and escape a stored image attribute value before outputting it, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the...

EUVD-2026-75969

The Featured Image with URL WordPress plugin before 1.0.6 does not sanitise and escape a stored image attribute value before outputting it, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the...

CVE-2026-86780

The Featured Image with URL WordPress plugin before 1.0.6 does not sanitise and escape a stored image attribute value before outputting it, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the...

WordPress Featured Image with URL plugin < 1.0.6 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Artus KG in WordPress Plugin Featured Image with URL versions 1.0.6...

CVE-2026-86780 Featured Image with URL < 1.0.6 - Contributor+ Stored XSS via Image Alt Text

The Featured Image with URL WordPress plugin before 1.0.6 does not sanitise and escape a stored image attribute value before outputting it, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the...

PT-2026-89786

The Featured Image with URL WordPress plugin before 1.0.6 does not sanitise and escape a stored image attribute value before outputting it, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the...

SUSE CVE-2026-34031

Unrestricted Upload of File with Dangerous Type vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. The server did not sufficiently validate user-supplied image URLs, allowing arbitrary external content to be embedded as profile images, which could expose users to...

WordPress wpDiscuz plugin < 7.6.60 - Unauthenticated Stored XSS via Image URL Conversion vulnerability

Unauthenticated Stored XSS via Image URL Conversion vulnerability discovered by hieus in WordPress Plugin wpDiscuz versions 7.6.60...

EUVD-2026-41150

Wagtail: Reflected XSS in dynamic image URL generator view...

Wagtail: Reflected XSS in dynamic image URL generator view

Impact A reflected cross-site scripting XSS vulnerability exists on the dynamic image URL generator view within the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail admin could craft a URL that, when viewed by a user with higher privileges, could perform...

CVE-2026-71567

CVE-2026-71567 affects openshift-metal3/fakefish , a tool used for provisioning bare-metal infrastructure. The vulnerability is a shell injection caused by unquoted shell variables being inserted into command lines and Kubernetes manifests. The primary attack vectors are the Image URL and BMC cre...

EUVD-2026-60193

In openshift-metal3/fakefish there is a repeated pattern in some of the scripts where shell variables are injected without quoting them either into command lines or into manifests. This mostly applies to the Image URL and BMC credentials which are not verified by FakeFish...

PT-2026-76672

In openshift-metal3/fakefish there is a repeated pattern in some of the scripts where shell variables are injected without quoting them either into command lines or into manifests. This mostly applies to the Image URL and BMC credentials which are not verified by FakeFish...

CVE-2026-71567: Improper Neutralization of Special Elements used in an OS Command

In openshift-metal3/fakefish there is a repeated pattern in some of the scripts where shell variables are injected without quoting them either into command lines or into manifests. This mostly applies to the Image URL and BMC credentials which are not verified by FakeFish...