Approved changes feed: RSS · Atom
cpe:2.3:a:danpros:htmly:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Danpros (babec895-2b3f-5bd0-a8cd-4ce0583fa6c7) |
|---|---|
| Product | Htmly (952972c2-faf4-5cc5-b3b4-20d380dc9cbf) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-57940 |
vulnerable | 2026-07-29 01:03:16.427552 |
Details available
HTMLy 3.1.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the RSS feed import functionality. The function get_feed() in system/admin/admin.php passes user-supplied $feed_url directly to file_get_contents() without any validation. An authenticated attacker with administrative privileges can exploit this by entering a crafted URL (e.g., http://dnslog.example.com, file:///etc/passwd, or http://169.254.169.254 in cloud contexts) via Tools -> Import RSS. The server will then make a request to the attacker-controlled target.
Published: 2026-06-26T13:08:02.485Z
Updated: 2026-06-26T13:25:52.575Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-45233 |
vulnerable | 2026-07-29 00:52:15.204751 |
HTMLy CMS 3.1.1 Path Traversal via oldfile Parameter in Autosave
HIGH (8.1)
HTMLy CMS through 3.1.1 contains a path traversal vulnerability that allows low-privileged authenticated attackers to relocate arbitrary files by supplying directory traversal sequences in the oldfile parameter at the admin autosave endpoint. Attackers can pass unsanitized traversal sequences directly to file_exists() and rename() functions in admin.php without canonicalization or directory boundary enforcement to cause unintended relocation of any file writable by the web server process to an attacker-specified draft location.
Published: 2026-06-25T15:50:00.181Z
Updated: 2026-07-28T01:48:57.352Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.