Log in Start free

Vulnerability · Published Oct 26, 2026 · Assigned by VulDB

CVE-2026-116223icret EasyImage del.php privileges management

Medium 6.5

In plain English

A medium-severity privilege mismanagement in EasyImage from icret. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.3%top 72.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A flaw has been found in icret EasyImage up to 2.8.7. The impacted element is an unknown function of the file app/del.php. Executing a manipulation of the argument hash can lead to improper privilege management. The attack can be launched remotely. The exploit has been published and may be used. This patch is called b12cb67d447bcbb67e21c8f011d0f5638229760c. A patch should be applied to remediate this issue.

Affected products (as reported)

VendorProductVersions
icret EasyImage 2.8.02.8.12.8.22.8.32.8.42.8.52.8.62.8.7

Weakness: CWE-269, CWE-266 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C

References