48 matches found
CVE-2026-33933 Reflected XSS via Unescaped contextName Parameter in Custom Template Editor
OpenEMR is a free and open source electronic health records and medical practice management application. Starting in version 7.0.2.1 and prior to version 8.0.0.3, a reflected cross-site scripting XSS vulnerability in the custom template editor allows an attacker to execute arbitrary JavaScript in...
CVE-2026-33933 Reflected XSS via Unescaped contextName Parameter in Custom Template Editor
OpenEMR is a free and open source electronic health records and medical practice management application. Starting in version 7.0.2.1 and prior to version 8.0.0.3, a reflected cross-site scripting XSS vulnerability in the custom template editor allows an attacker to execute arbitrary JavaScript in...
Linux Distros Unpatched Vulnerability : CVE-2026-25731
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - calibre is an e-book manager. Prior to 9.2.0, a Server-Side Template Injection SSTI vulnerability in Calibre's Templite templating engine allows arbitrary code...
EUVD-2017-9702
Malware in sbrugna...
EUVD-2018-13446
Malware in sbrugna...
EUVD-2021-31776
Malicious code in bioql PyPI...
PT-2025-30213 · Logpoint · Logpoint
Name of the Vulnerable Software and Affected Versions: Logpoint versions prior to 7.6.0 Description: An issue exists in Logpoint that allows attackers to create custom Jinja templates when creating reports. By chaining built-in filter functions within these templates, attackers can generate...
CVE-2018-20908
cPanel before 71.9980.37 allows arbitrary file-read operations during pkgacct custom template handling SEC-435...
Query to create a custom Smartcard FAS template
Request for instruction to modify FAS template or create a custom template with following configuration. Secure email Client authentication Smart card logon...
Remote code execution
iCMS = 8.0.0 allows users to add and render a comtom template, which has a SSTI vulnerability which causes remote code execution...
Ivanti Pulse Connect Secure Code Execution Vulnerability
Ivanti Pulse Connect Secure contains an unspecified vulnerability in the admin web interface that could allow an authenticated attacker to upload a custom template to perform code execution...
Sql injection
A SQL injection vulnerability exists with user privileges in library/customtemplate/ajaxcode.php in OpenEMR 5.0.2.1...
CVE-2021-32102
A SQL injection vulnerability exists with user privileges in library/customtemplate/ajaxcode.php in OpenEMR 5.0.2.1...
OpenEMR SQL注入漏洞
OpenEMR is a medical practice management software that also supports electronic medical records EMR. A SQL injection vulnerability exists in library/customtemplate/ajaxcode.php in OpenEMR version 5.0.2.1. No detailed vulnerability details are provided at this time...
CVE-2020-7159
A customtemplateselect expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center iMC versions: Prior to iMC PLAT 7.3 E0705P07...
OpenEMR Cross-Site Scripting Vulnerability (CNVD-2019-41603)
OpenEMR is an open source medical management system from the OpenEMR community. The system can be used for medical practice management, electronic medical records, prescription writing and medical billing requests. A cross-site scripting vulnerability exists in the...
GitLab: Project Template functionality can be used to copy private project data, such as repository, confidential issues, snippets, and merge requests
I've found a three minor vulnerabilities which, when combined, allow an attacker to copy private repositories, confidential issues, private snippets, and then some. I'll go through the code path to explain the vulnerabilities and how they are combined. See the Proof of Concept section if you want...
CVE-2017-18586
The insert-pages plugin before 3.2.4 for WordPress has directory traversal via custom template paths...
