CVE-2026-48832

LowCVSS 3.5/10Last modified Jul 23, 2026

Description

action/cookie.php in ecrire in SPIP before 4.4.15 is prone to an open redirect vulnerability.

Metrics

CVSS 3.1 3.5/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N

Weakness enumeration

CWE-601

Affected software

No affected versions have been published.

Timeline

Published
May 24, 2026
Last modified
Jul 23, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-488347.5Improper Handling of Length Parameter Inconsistency vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. UnautCVE-2026-488357.5Unauthenticated Broken Access Control in Contact Form by WPForms <= 1.10.0.4 versions.CVE-2026-4883610.0Unauthenticated Remote Code Execution (RCE) in Easy Invoice <= 2.1.19 versions.CVE-2026-488378.5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Unlimited Elements For Elementor allowCVE-2026-488387.1Unauthenticated Cross Site Scripting (XSS) in Post SMTP <= 3.6.2 versions.CVE-2026-488397.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP Statistics allows DOM-BaCVE-2026-488405.3Exim 4.88 before 4.99.4, in some proxy configurations, mishandles certain short payloads, leading to disclosure of uninitialized stack memorCVE-2026-488428.1Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_reCVE-2026-488437.2Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16,and 1.7.x before 1.7.1 has Insufficient Cascading Style Sheets (CSS) sanitization in HTML CVE-2026-488447.5Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation logic in LDAP the autovalues option that could leaCVE-2026-488456.5In Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16 and 1.7.x before 1.7.1, remote image blocking was not honored for URLs pointing to locaCVE-2026-488466.5In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, the remote image blocking feature can be bypassed via a crafted CSS var() v
CVE-2026-48832: Low severity, CVSS 3.5 | Vulnix