CVE-2026-78397mediumCWE-918

CVE-2026-78397: falha de média gravidade em Link Library

Link Library < 7.9.6 - Unauthenticated SSRF via Reciprocal Link Validation

Publicada em

Seguir esta CVE+ Monitorar Link Library

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

33Vexday Risk Score

Sem sinal de exploração. Ela tem prova de conceito pública.

ssvc Attendcvss 4epss 0.2%
The Link Library WordPress plugin before 7.9.6 does not validate the destination of a user-supplied URL before falling back to an unprotected fetch when its safe request is rejected, allowing unauthenticated visitors to make the site issue requests to hosts on its internal network and to learn from the response whether an internal service answered. Versions below 7.8.8 are covered by CVE-2025-68600; this entry covers 7.8.8 through 7.9.5, where that fix was incomplete. Exploitation requires the site owner to have published the Link Library WordPress plugin before 7.9.6's public link submission form with reciprocal-link validation enabled.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
Produtos afetados
Unknown · Link Library
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — Link Library

No mesmo produto, das mais perigosas para as menos.

CVE-2021-25093—Link Library < 7.2.8 - Unauthenticated Arbitrary Links DeletionEPSS 1.2%CVE-2021-25091—Link Library < 7.2.9 - Reflected Cross-Site ScriptingEPSS 0.8%CVE-2026-16535MEDIUMLink Library < 7.9.4 - Reflected XSS via Thumbs-Rating likelabelEPSS 0.5%CVE-2021-25092—Link Library < 7.2.8 - Library Settings Reset via CSRFEPSS 0.5%CVE-2022-4199MEDIUMLink Library < 7.4.1 - Admin+ Stored XSSEPSS 0.5%CVE-2026-16532CRITICALLink Library < 7.9.3 - Unauthenticated SQL Injection via the Front-End Link Submission FormEPSS 0.5%