CVE-2022-31290

CVE-2022-31290 : A cross-site scripting (XSS) vulnerability exists in Known v1.2.2+2020061101 where an authenticated attacker can inject arbitrary web scripts or HTML via the Your Name text field. Public records (NVD and Red Hat advisories) identify the affected product/version and the underlying...

CVE-2022-33011

CVE-2022-33011 affects Known (open-source social publishing platform). Multiple connected sources corroborate an account takeover via host header injection in v1.3.1 and earlier. Red Hat, Veracode and OSV entries describe the root cause as lack of validation in the password reset flow, notably in...

CVE-2022-32115

Known is affected by a vulnerability in the isSVG() function that enables arbitrary code execution via a crafted SVG file. Affected versions include Known v1.2.2+2020061101 and v1.3.1, with discussion across multiple feeds indicating the issue resides in isSVG() and impacts how SVGs are parsed. E...

CVE-2022-30852

Known v1.3.1 contains an Insecure Direct Object Reference (IDOR) in the Known CMS. The vulnerability arises from getContent()/postContent() in the Homepage class (Homepage.php), where createGatekeeper() enables unauthorized access to admin settings, effectively exposing admin-panel configuration ...

CVE-2026-28507

CVE-2026-28507 affects Idno (social publishing platform). Public disclosures and Red Hat/Veracode entries describe two chained vulnerabilities leading to remote code execution: 1) Arbitrary PHP file write during WordPress import via importImagesFromBodyHTML, leveraging uncontrolled outbound fopen...

CVE-2026-26273

Known (social publishing platform) prior to version 1.6.3 contains a critical Broken Authentication weakness in 1.6.2 and earlier: the password reset token is leaked in a hidden HTML input field on the password reset page, allowing unauthenticated attackers to retrieve the token by querying the u...

CVE-2026-28508

CVE-2026-28508 affects Idno: prior to 1.6.4, a logic error in the API authentication flow and missing login requirement on the URL unfurl endpoint results in CSRF protection bypass for unauthenticated requests. An attacker can set X-IDNO-USERNAME and X-IDNO-SIGNATURE headers to trigger is_api_req...