jte's HTML templates containing Javascript template strings are subject to XSS

Summary Jte HTML templates with script tags or script attributes that include a Javascript template string backticks are subject to XSS. Details The javaScriptBlock and javaScriptAttribute methods in the Escape class source do not escape backticks, which are used for Javascript template strings...

GHSA-VH22-6C6H-RM8Q jte's HTML templates containing Javascript template strings are subject to XSS

Summary Jte HTML templates with script tags or script attributes that include a Javascript template string backticks are subject to XSS. Details The javaScriptBlock and javaScriptAttribute methods in the Escape class source do not escape backticks, which are used for Javascript template strings...

CVE-2024-44771

BigId PrivacyPortal v179 is vulnerable to Cross Site Scripting XSS via the "Label" field in the Report template function...

jte 安全漏洞

jte Java Template Engine is a secure and fast template for Java and Kotlin by the individual developer Andreas Hager. A security vulnerability exists in jte 3.1.15 and earlier versions, which stems from improper escaping of backquotes in JavaScript template strings and is vulnerable to cross-site...

next-forge 安全漏洞

next-forge is a production-grade Turborepo template for the Next.js application by Hayden Bleasel, an individual developer. A security vulnerability exists in versions prior to next-forge 3.0.11 that stems from the submission of BASEHUBTOKEN in the apps/web/.env.example file, which could lead to...

BigId PrivacyPortal 安全漏洞

BigId PrivacyPortal is a data security and privacy tool from BigId, Inc. A security vulnerability exists in BigId PrivacyPortal version v179 that stems from a cross-site scripting XSS attack on the Label field in the Report Template feature...

CVE-2024-44771

BigId PrivacyPortal v179 is vulnerable to Cross Site Scripting XSS via the "Label" field in the Report template function...

CVE-2024-44771

BigId PrivacyPortal v179 is vulnerable to Cross-Site Scripting (XSS) via the "Label" field in the Report template function. The vulnerability is described across multiple sources as a UI/XSS issue in the PrivacyPortal’s Report Template feature. No remediation details are provided in the supplied ...

[SECURITY] Fedora 41 Update: python-jinja2-3.1.5-1.fc41

Jinja2 is a template engine written in pure Python. It provides a Django inspired non-XML syntax but supports inline expressions and an optional sandboxed environment. If you have any exposure to other text-based template languages, such as Smarty or Django, you should feel right at home with...

PT-2025-1753 · WordPress · The Unlimited Theme Addon For Elementor/Woocommerce

Name of the Vulnerable Software and Affected Versions: The Unlimited Theme Addon For Elementor and WooCommerce plugin for WordPress versions up to, and including, 1.2.1 Description: The issue allows authenticated attackers with Contributor-level access and above to extract data from private or...

OESA-2025-1030 python-jinja2 security update

Jinja2 is one of the most used template engines for Python. It is inspired by Django's templating system but extends it with an expressive language that gives template authors a more powerful set of tools. On top of that it adds sandboxed execution and optional automatic escaping for applications...

WordPress plugin AI Scribe SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin AI...

PT-2025-1862 · WordPress · Ai Scribe

Name of the Vulnerable Software and Affected Versions: AI Scribe plugin for WordPress versions up to, and including, 2.3 Description: The issue is related to SQL Injection via the template id parameter of the article builder generate data shortcode. This is due to insufficient escaping on the...

CVE-2024-56114

Canlineapp Online 1.1 is vulnerable to Broken Access Control and allows users with the Auditor role to create an audit template as a result of improper authorization checks. This feature is designated for supervisor role, but auditors have been able to successfully create audit templates from the...

CVE-2025-22802 WordPress Email Templates Customizer YeeMail plugin <= 2.1.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in add-ons.org Email Templates Customizer for WordPress – Drag And Drop Email Templates Builder – YeeMail allows Stored XSS.This issue affects Email Templates Customizer for WordPress – Drag And Drop...

CVE-2024-11642

The Post Grid Master – Custom Post Types, Taxonomies & Ajax Filter Everything with Infinite Scroll, Load More, Pagination & Shortcode Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.4.12 via the 'locatetemplate' function. This makes it...

PT-2025-3193 · Unknown · Canlineapp Online

Name of the Vulnerable Software and Affected Versions: Canlineapp Online version 1.1 Description: The issue concerns improper authorization checks, allowing users with the Auditor role to create an audit template, a feature designated for the supervisor role. This results from broken access...

The vulnerability of the Netflow v9 protocol implementation of the FastNetMon detection and prevention DDoS attack tool allows a perpetrator to cause a service failure.

The vulnerability in the implementation of the Netflow v9 protocol for the FastNetMon tool, which is used for detecting and preventing DDoS attacks, stems from the lack of checks for division by zero when processing templates. Exploiting this vulnerability could allow a malicious actor to cause...

The vulnerability of the str.format() method in the Jinja HTML templating tool allows a attacker to bypass the sandbox protection mechanisms, execute arbitrary code, or cause a denial-of-service attack.

The vulnerability of the str.format method in the Jinja HTML templating tool is related to the lack of mechanisms to eliminate special elements in the template creation process. Exploiting this vulnerability can allow an attacker to bypass the sandbox’s security measures, execute arbitrary code, ...

Server-side Template Injection (SSTI)

opencart/opencart is vulnerable to Server-Side Template Injection SSTI. The vulnerability is due to improper validation and sanitization of user inputs within the Theme Editor Function, allows attackers to inject malicious template code that can be executed on the server...