CVE-2026-6649

MediumCVSS 6.3

Published: 20/04/2026(UTC)Updated: 26/10/2026(UTC)Translated: 27/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

10th percentile - higher than 10% of all known CVEs

Summary

A vulnerability was found in Qibo CMS 1.0 affecting an unknown function of the /index/image/headers file. Manipulating the starts argument can lead to server-side request forgery, and the attack can be launched remotely. The exploit has been publicly disclosed.

Risk Assessment

SSRF may allow an attacker to make server-side requests to internal resources, risking data exposure or access to internal services. The public exploit increases the likelihood of exploitation.

Recommendation

Update Qibo CMS to a patched version or restrict access to the vulnerable endpoint. Until a fix is available, consider validating and limiting outbound server requests.

Other vulnerabilities in Qibo CMS

CVE-2026-6648Low
A cross-site scripting vulnerability was found in the Internal Message Module of Qibo CMS 1.0. The attack can be initiated remotely and the exploit has been made public. The vendor did not respond to the disclosure.

Original NVD description (English source)

A vulnerability was determined in Qibo CMS 1.0. Affected by this issue is some unknown functionality of the file /index/image/headers. Executing a manipulation of the argument starts can lead to server-side request forgery. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS