CVE-2026-28507

CVE-2026-28507 affects Idno (social publishing platform). Public disclosures and Red Hat/Veracode entries describe two chained vulnerabilities leading to remote code execution: 1) Arbitrary PHP file write during WordPress import via importImagesFromBodyHTML, leveraging uncontrolled outbound fopen...

CVE-2026-26273

Known (social publishing platform) prior to version 1.6.3 contains a critical Broken Authentication weakness in 1.6.2 and earlier: the password reset token is leaked in a hidden HTML input field on the password reset page, allowing unauthenticated attackers to retrieve the token by querying the u...

CVE-2026-28508

CVE-2026-28508 affects Idno: prior to 1.6.4, a logic error in the API authentication flow and missing login requirement on the URL unfurl endpoint results in CSRF protection bypass for unauthenticated requests. An attacker can set X-IDNO-USERNAME and X-IDNO-SIGNATURE headers to trigger is_api_req...