HTMLy vulnerabilities

3 known CVE vulnerabilities in HTMLy, translated and rated.

CVE-2026-37107Unknown
An issue in HTMLy v.3.1.1 allows a remote attacker to escalate privileges via the get_feed function in the admin.php component.
CVE-2026-18644Medium
A vulnerability in danpros HTMLy up to 3.1.1, affecting the unlink function in /system/htmly.php of the Delete Username Endpoint component, allows manipulation of the File argument leading to path traversal. The attack can be launched remotely, and the exploit is publicly available.
CVE-2022-25022Medium
A cross-site scripting (XSS) vulnerability in Htmly v2.8.1 allows attackers to execute arbitrary HTML scripts via a crafted payload in the content field of a blog post.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS