CVE-2026-37107
UnknownSummary
An issue in HTMLy v.3.1.1 allows a remote attacker to escalate privileges via the get_feed function in the admin.php component.
Risk Assessment
An attacker can elevate their privileges within the application, potentially leading to unauthorized access to administrative functions and data. This may result in site takeover or information disclosure.
Recommendation
Update HTMLy to a patched version or restrict access to the admin.php component. Verify user privileges and review logs for suspicious activity.
Other vulnerabilities in HTMLy
See all- CVE-2026-18644Medium
A vulnerability in danpros HTMLy up to 3.1.1, affecting the unlink function in /system/htmly.php of the Delete Username Endpoint component, allows manipulation of the File argument leading to path traversal. The attack can be launched remotely, and the exploit is publicly available.
- CVE-2022-25022Medium
A cross-site scripting (XSS) vulnerability in Htmly v2.8.1 allows attackers to execute arbitrary HTML scripts via a crafted payload in the content field of a blog post.
Original NVD description (English source)
An issue in HTMLy v.3.1.1 allows a remote attacker to escalate privileges via the get_feed function in the admin.php component
Vulnerability data from NVD (NIST) · CISA KEV · EPSS