CVE-2026-38949

Published April 28th, 2026

View on NVD ↗

CVSS v3

8.9

HIGH

CVSS v2

N/A

Affected

PROJECTS

Description

Cross-Site Scripting (XSS) vulnerability exists in HTMLy version 3.1.1 in the content creation functionality at the /add/content?type=image endpoint. The application fails to properly sanitize user input, allowing injection of arbitrary code

danpros/htmly

Simple and fast databaseless PHP blogging platform, and Flat-File CMS

GitHub

1.34K

Chittu13/cve-research

GitHub