CVE-2026-6649mediumCWE-918

CVE-2026-6649: medium-severity vulnerability in Qibo CMS

Qibo CMS headers server-side request forgery

Published

Follow this CVE+ Monitor CMS

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 5.3epss 0.2%
A vulnerability was determined in Qibo CMS 1.0. Affected by this issue is some unknown functionality of the file /index/image/headers. Executing a manipulation of the argument starts can lead to server-side request forgery. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
Qibo · CMS
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Qibo CMS

In the same product, most dangerous first.

CVE-2026-6648MEDIUMQibo CMS Internal Message cross site scriptingEPSS 0.2%