These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A vulnerability was found in InstantSoft icms2 up to 2.18.2 in the Private Message Handler component. The issue is caused by cross-site scripting (XSS) in the nickname argument of the index function in templates/default/controllers/messages/index.tpl.php. The attack can be launched remotely. A patch (3a1ec8fcb073a46d06a2ab83bc2bf68225834281) is available to resolve this issue.
CVE-2026-48707 debrief based on InstantCMS source corpus. The vulnerability is a Server-Side Request Forgery (SSRF) in the file upload functionality of InstantCMS versions prior to 2.18.2. This allows authenticated users to scan and access internal network services. The 'upload from URL' feature follows an HTTP redirect, bypassing the private IP address blacklist check. Administrators should verify and re [truncated]