EUVD-2026-21557

Chamilo LMS is a learning management system. Prior to 1.11.38, Twig template files .tpl under /main/template/default/ are directly accessible without authentication via HTTP GET requests. These templates expose internal application logic, variable names, AJAX endpoint URLs, and admin panel...

Cross site scripting

The Asgaros Forums WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the name parameter found in the /admin/tables/admin-structure-table.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to...

CVE-2021-42365: Improper Neutralization of Input During Web Page Generation

The Asgaros Forums WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the name parameter found in the /admin/tables/admin-structure-table.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to...

PT-2021-23597

Name of the Vulnerable Software and Affected Versions Asgaros Forums WordPress plugin versions up to and including 1.15.13 Description The issue is related to Stored Cross-Site Scripting due to insufficient escaping via the name parameter found in the /admin/tables/admin-structure-table.php file...

WordPress plugin cross-site scripting vulnerability

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL servers to set up a personal blog site.WordPress Plugin is a WordPress open source application plugin . WordPress plugin Asgaros Forums 1.15.13 and its previous...

PT-2014-5332

Name of the Vulnerable Software and Affected Versions Flag module versions 7.x-3.0 through 7.x-3.5 Description The issue allows remote authenticated administrators to execute arbitrary PHP code via the "Flag import code" text area in the /admin/structure/flags/import API endpoint. This could...

CVE-2014-3453: Improper Control of Generation of Code

Eval injection vulnerability in the flagimportformvalidate function in includes/flag.export.inc in the Flag module 7.x-3.0, 7.x-3.5, and earlier for Drupal allows remote authenticated administrators to execute arbitrary PHP code via the "Flag import code" text area to admin/structure/flags/import...