CVE-2023-50786

—

CVSS 3.1

4.3 medium

EPSS

<1%p15

Published

Jul 5, 2025 (Jul 5, 2025)

Modified

Jun 17, 2026

Description

Dradis through 4.16.0 allows referencing external images (resources) over HTTPS, instead of forcing the use of embedded (uploaded) images. This can be leveraged by an authorized author to attempt to steal the Net-NTLM hashes of other authors on a Windows domain network.

Vendors: dradisframework
Products: dradis
Weakness: CWE-294
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.2%)

In the news0 stories

No ingested article mentions this CVE yet.