https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T15:36:19.505499+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2018-21604 cnvd-2018-21604 2026-10-06T15:36:19.510486+00:00 cnvd-2018-21604 https://cve.radiocsirt.org/vuln/euvd-2026-251407 EUVD-2026-251407 2026-10-06T15:36:19.510528+00:00 EUVD-2026-251407 https://cve.radiocsirt.org/vuln/fkie_cve-2018-18307 fkie_cve-2018-18307 2026-10-06T15:36:19.510548+00:00

A Stored XSS vulnerability has been discovered in version 4.1.0 of AlchemyCMS via the /admin/pictures image field. NOTE: the vendor's position is that this is not a valid report: "The researcher used an authorized cookie to perform the request to a password-protected route. Without that session cookie, the request would have been rejected as unauthorized."

 https://cve.radiocsirt.org/vuln/ghsa-7mj4-2984-955f Withdrawn: GHSA-7mj4-2984-955f — Withdrawn Advisory: AlchemyCMS is vulnerable to stored XSS via the /admin/pictures image field 2026-10-06T15:36:19.510589+00:00

Withdrawn by the publisher.

Affected: RubyGems: alchemy_cms

## Withdrawn Advisory

This advisory has been withdrawn because it does not describe a vulnerability. The maintainer states the following:

> The researcher used an authorized cookie to perform the request to a password-protected route. Without that session cookie, the request would have been rejected as unauthorized.

## Original Description

A Stored XSS vulnerability has been discovered in version 4.1.0 of AlchemyCMS via the /admin/pictures image field.

 https://cve.radiocsirt.org/vuln/gsd-2018-18307 gsd-2018-18307 2026-10-06T15:36:19.510632+00:00 gsd-2018-18307