CVE-2026-103584

CVE-2026-103584: Unsafe license URLs in CommonsMetadata Reporter: Marco Paciaroni BomboBombone. CommonsMetadata copied the licensetpllink value from a file description into the LicenseUrl field of image metadata without restricting its URL scheme. An editor could store a javascript: URL. When an...

Exploit for CVE-2026-103585

CVE-2026-103585: Stored XSS in MediaSearch QuickView Reporter...

Exploit for CVE-2026-103584

CVE-2026-103584: Unsafe license URLs in CommonsMetadata Repor...