Vulnerabilities

TI-2026-81170 CVE-2026-117566 · GHSA-59pp-4mv4-4j8f

Path traversal in EasyImages2.0 lets attackers read server files

LOW 36

EasyImages2.0 through 2.8.6 contains an unauthenticated path traversal vulnerability in app/down.php, app/thumb.php and app/info.php that allows reading files outside the upload directory.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00353 Published 2026-10-27 No fix listed CWE-22

TI-2026-80264 CVE-2026-116223 · GHSA-9f4j-8wcf-9rx4

icret EasyImage del.php privileges management

HIGH 70

A flaw has been found in icret EasyImage up to 2.8.7.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00336 Published 2026-10-26 No fix listed CWE-266

TI-2025-40366 CVE-2025-65474 · GHSA-gqxx-w4v2-wmm2

An arbitrary file rename vulnerability in the /admin/manager.php component of EasyImages…

HIGH 76

An arbitrary file rename vulnerability in the /admin/manager.php component of EasyImages 2.0 v2.8.6 and below allows attackers to execute arbitrary code via renaming a PHP file to a SVG format.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00541 Published 2025-12-11 No fix listed CWE-434

TI-2025-40365 CVE-2025-65473 · GHSA-8v7x-7wjw-jmqc

An arbitrary file rename vulnerability in the /admin/filer.php component of EasyImages…

HIGH 74

An arbitrary file rename vulnerability in the /admin/filer.php component of EasyImages 2.0 v2.8.6 and below allows attackers with Administrator privileges to execute arbitrary code via injecting a crafted payload into an…

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.00569 Published 2025-12-11 No fix listed CWE-73

TI-2025-40364 CVE-2025-65472 · GHSA-j2gr-v3pp-p7fc

A Cross-Site Request Forgery (CSRF) in the /admin/admin.inc.php component of EasyImages…

HIGH 73

A Cross-Site Request Forgery (CSRF) in the /admin/admin.inc.php component of EasyImages 2.0 v2.8.6 and below allows attackers to escalate privileges to Administrator via user interaction with a malicious web page.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00208 Published 2025-12-11 No fix listed CWE-352

TI-2025-40363 CVE-2025-65471 · GHSA-6gr4-9gjr-4gw8

An arbitrary file upload vulnerability in the /admin/manager.php component of EasyImages…

HIGH 73

An arbitrary file upload vulnerability in the /admin/manager.php component of EasyImages 2.0 v2.8.6 and below allows attackers to execute arbitrary code via uploading a crafted PHP file.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00535 Published 2025-12-11 No fix listed CWE-434

TI-2025-12264 CVE-2025-13415 · GHSA-622j-2666-j97g

icret EasyImages SVG Image upload.php cross site scripting

MEDIUM 56

A vulnerability was identified in icret EasyImages up to 2.8.6.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00246 Published 2025-11-19 No fix listed CWE-79

TI-2023-06493 CVE-2023-7098 · GHSA-66jv-2xqf-9p8x

icret EasyImages hide.php path traversal

LOW 25

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic was found in icret EasyImages 2.8.3.

CVSS 3.1MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00656 Published 2023-12-25 No fix listed CWE-24

TI-2023-16595 CVE-2023-33599 · GHSA-8v5x-fmhg-hw3q

EasyImages2.0 ≤ 2.8.1 is vulnerable to Cross Site Scripting (XSS) via viewlog.php.

MEDIUM 60

EasyImages2.0 ≤ 2.8.1 is vulnerable to Cross Site Scripting (XSS) via viewlog.php.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00434 Published 2023-05-23 No fix listed CWE-79

TI-2023-01117 CVE-2023-1181 · GHSA-g846-84w5-3m6g

Cross-site Scripting (XSS) - Stored in icret/easyimages2.0

MEDIUM 58

Cross-site Scripting (XSS) - Stored in GitHub repository icret/easyimages2.0 prior to 2.6.7.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00429 Published 2023-03-05 Fixed in 2.6.7 CWE-79

Vulnerabilities

Filters