CVE-2025-31767

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in OTWthemes Post Custom Templates Lite post-custom-templates-lite allows Stored XSS.This issue affects Post Custom Templates Lite: from n/a through = 1.14...

CVE-2025-31767: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in OTWthemes Post Custom Templates Lite post-custom-templates-lite allows Stored XSS.This issue affects Post Custom Templates Lite: from n/a through = 1.14...

WordPress plugin Post Custom Templates Lite 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting vulnerabili...

CVE-2024-43405 Nuclei Template Signature Verification Bypass

Nuclei is a vulnerability scanner powered by YAML based templates. Starting in version 3.0.0 and prior to version 3.3.2, a vulnerability in Nuclei's template signature verification system could allow an attacker to bypass the signature check and possibly execute malicious code via custom code...

UBUNTU-CVE-2024-32875

Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.125.3, title arguments in Markdown for links and images not escaped in internal render hooks. Hugo users who are impacted are those who have these hooks enabled and do not trust their Markdown content files. The...

UBUNTU-CVE-2023-3399

An issue has been discovered in GitLab EE affecting all versions starting from 11.6 before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions starting from 16.5 before 16.5.1. It was possible for an unauthorised project or group member to read the CI/CD variables using the custom...

Remote code execution

Kimai is a web-based multi-user time-tracking application. Versions prior to 2.1.0 are vulnerable to a Server-Side Template Injection SSTI which can be escalated to Remote Code Execution RCE. The vulnerability arises when a malicious user uploads a specially crafted Twig file, exploiting the...

Nuclei Path Traversal vulnerability

Overview We have identified and addressed a security issue in the Nuclei project that affected users utilizing Nuclei as Go code SDK running custom templates. This issue did not affect CLI users. The problem was related to sanitization issues with payloads loading in sandbox mode. Details In the...

GHSA-2XX4-JJ5V-6MFF Nuclei Path Traversal vulnerability

Overview We have identified and addressed a security issue in the Nuclei project that affected users utilizing Nuclei as Go code SDK running custom templates. This issue did not affect CLI users. The problem was related to sanitization issues with payloads loading in sandbox mode. Details In the...

Stored XSS vulnerability in custom email templates in email-ext

email-ext allows defining custom email templates using https://plugins.jenkins.io/config-file-provider/Config File Provider plugin as Jelly or Groovy files. The Email Template Testing feature can be used to see what these templates would look like based on a given build by specifying the managed:...

CVE-2021-44978

iCMS = 8.0.0 allows users to add and render a comtom template, which has a SSTI vulnerability which causes remote code execution...

CVE-2021-44978

iCMS = 8.0.0 allows users to add and render a comtom template, which has a SSTI vulnerability which causes remote code execution...

CVE-2021-42650

Cross Site Scripting XSS vulnerability exists in Portainer before 2.9.1 via the node input box in Custom Templates...

CVE-2021-42650

Cross Site Scripting XSS vulnerability exists in Portainer before 2.9.1 via the node input box in Custom Templates...

Cross site scripting

Cross Site Scripting XSS vulnerability exists in Portainer before 2.9.1 via the node input box in Custom Templates...

CVE-2021-42650

Cross Site Scripting XSS vulnerability exists in Portainer before 2.9.1 via the node input box in Custom Templates...

CVE-2021-42650

Portainer contains an XSS vulnerability in Custom Templates via the node input box that affects versions before 2.9.1. The CVSS2/3.1 scores indicate MEDIUM risk with network access and no authentication required, but user interaction is not required under CVSSv2 and is required under CVSSv3.1, wi...

Portainer 跨站脚本漏洞

Portainer is a lightweight user management interface for managing Docker environments and Docker hosts. Portainer suffers from a cross-site scripting vulnerability that stems from a cross-site scripting XSS vulnerability in the node input box in custom templates prior to Portainer version 2.9.1...

CVE-2021-42650: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS vulnerability exists in Portainer before 2.9.1 via the node input box in Custom Templates...

CVE-2021-33203

Django before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 has a potential directory traversal via django.contrib.admindocs. Staff members could use the TemplateDetailView view to check the existence of arbitrary files. Additionally, if and only if the default admindocs templates have been...