EUVD-2026-78928

Concrete CMS before 9.5.3 does not apply HTML entity encoding to user-defined Form block question labels when rendering them as column headers in the Dashboard Form Submissions report concrete/singlepages/dashboard/reports/forms/legacy.php. a rogue editor could store markup or script in a label...

PT-2026-92130

Concrete CMS before 9.5.3 does not apply HTML entity encoding to user-defined Form block question labels when rendering them as column headers in the Dashboard Form Submissions report concrete/single pages/dashboard/reports/forms/legacy.php. a rogue editor could store markup or script in a label...

EUVD-2013-4801

Malware in sbrugna...

CVE-2013-4957

The dashboard report in Puppet Enterprise before 3.0.1 allows attackers to execute arbitrary YAML code via a crafted report-specific type...

CVE-2013-4957

The dashboard report in Puppet Enterprise before 3.0.1 allows attackers to execute arbitrary YAML code via a crafted report-specific type...

CVE-2013-4957: Improper Control of Generation of Code

The dashboard report in Puppet Enterprise before 3.0.1 allows attackers to execute arbitrary YAML code via a crafted report-specific type...