8.2
HighCVSS 4.0 · from INCIBE
CVE-2026-14467
Display of information in the Forocoches comments editor
Forocoches comments editor · Information exposure · CWE-200AffectedForocoches comments editor
FixNo fix listed yet.
PublishedOct 30, 09:52 · INCIBE
ScoredOct 30 · 8.2 · INCIBE
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:05 UTC
What we know
No known exploitation. CISA KEV, checked 22:05 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, low privileges.
Someone has to open, click or run something first. CVSS: user interaction required.
A successful attack can read data. CVSS impact.
Description
An information disclosure vulnerability in the Forocoches comments editor that allows an attacker to obtain unauthorised user information by inserting an image containing a malicious external URL into a comment. When a victim views the discussion thread, their browser automatically sends an HTTP/HTTPS request to the server controlled by the attacker, who can then collect information such as the source IP address, the User-Agent header, the date and time of access, and other metadata derived from the request, thereby compromising the user’s privacy.
From INCIBE
Affected and fixed versions
ProductAffectedFixed inForocoches comments editorbefore May 2026–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known