Logo
Retour à la veille

CVE-2026-116223

Publié : 26 octobre 2026
Modifié : 26 octobre 2026
Lien officiel NVD
Score CVSS
6.5
MEDIUM

Description détaillée

A flaw has been found in icret EasyImage up to 2.8.7. The impacted element is an unknown function of the file app/del.php. Executing a manipulation of the argument hash can lead to improper privilege management. The attack can be launched remotely. The exploit has been published and may be used. This patch is called b12cb67d447bcbb67e21c8f011d0f5638229760c. A patch should be applied to remediate this issue.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Références et Patchs

https://gist.github.com/yyz8097/bc58546872ad90208d2b35260d84b1d9https://github.com/icret/EasyImages2.0/commit/b12cb67d447bcbb67e21c8f011d0f5638229760chttps://github.com/icret/EasyImages2.0/issues/283https://vuldb.com/cve/CVE-2026-116223https://vuldb.com/submit/1004976https://vuldb.com/vuln/426203https://vuldb.com/vuln/426203/cti

Dernières Vulnérabilités

CVE-2026-97295

Cross-Site Request Forgery (CSRF) vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Cross Site Request Forgery.This issue affects Media LIbrary Assistant: from n/a through 3.42.

VOIR DÉTAILS

CVE-2026-97255

Authorization Bypass Through User-Controlled Key vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Royal Elementor Addons: from n/a through 1.7.1069.

VOIR DÉTAILS

CVE-2026-97254

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Stored XSS.This issue affects Royal Elementor Addons: from n/a through 1.7.1069.

VOIR DÉTAILS