SQL Injection

magento/community-edition is vulnerable to SQL injection. The vulnerability is due to improper sanitization of input in email template variables, allowing a user with marketing privileges to execute arbitrary SQL queries in the database. Attackers can exploit this to manipulate the database,...

FoF Pretty Mail 1.1.2 - Server Side Template Injection (SSTI)

Exploit Title: FoF Pretty Mail 1.1.2 - Server Side Template Injection SSTI Date: 03/28/2024 Exploit Author: Chokri Hammedi Vendor Homepage: https://flarum.org/ Software Link: https://github.com/FriendsOfFlarum/pretty-mail Version: 1.1.2 Tested on: Windows XP CVE: N/A Description: The FoF Pretty...

FoF Pretty Mail 1.1.2 - Local File Inclusion (LFI)

Exploit Title: FoF Pretty Mail 1.1.2 - Local File Inclusion LFI Date: 03/28/2024 Exploit Author: Chokri Hammedi Vendor Homepage: https://flarum.org/ Software Link: https://github.com/FriendsOfFlarum/pretty-mail Version: 1.1.2 Tested on: Windows XP CVE: N/A Description: The FoF Pretty Mail extensi...

FoF Pretty Mail 1.1.2 Server-Side Template Injection Vulnerability

The server in Circontrol Raption versions through 5.11.2 has a pre-authentication stack-based buffer overflow that can be exploited to gain run-time control of the device as root. The pwrstudio web application of EV Charger in the server in Circontrol Raption through 5.6.2 is vulnerable to OS...

FoF Pretty Mail 1.1.2 Command Injection Vulnerability

Exploit Title: FoF Pretty Mail 1.1.2 Extension for Flarum Command Injection Exploit Author: Chokri Hammedi Vendor Homepage: https://flarum.org/ Software Link: https://github.com/FriendsOfFlarum/pretty-mail Version: 1.1.2 Tested on: Windows XP CVE: N/A Description: The FoF Pretty Mail extension fo...

FoF Pretty Mail 1.1.2 Local File Inclusion Vulnerability

Exploit Title: FoF Pretty Mail 1.1.2 Extension for Flarum Local File Inclusion LFI Exploit Author: Chokri Hammedi Vendor Homepage: https://flarum.org/ Software Link: https://github.com/FriendsOfFlarum/pretty-mail Version: 1.1.2 Tested on: Windows XP CVE: N/A Description: The FoF Pretty Mail...

FoF Pretty Mail 1.1.2 Server-Side Template Injection

Exploit Title: FoF Pretty Mail 1.1.2 Extension for Flarum Server-Side Template Injection SSTI Date: 03/28/2024 Exploit Author: Chokri Hammedi Vendor Homepage: https://flarum.org/ Software Link: https://github.com/FriendsOfFlarum/pretty-mail Version: 1.1.2 Tested on: Windows XP CVE: N/A Descriptio...

FoF Pretty Mail 1.1.2 Command Injection

Exploit Title: FoF Pretty Mail 1.1.2 Extension for Flarum Command Injection Date: 03/28/2024 Exploit Author: Chokri Hammedi Vendor Homepage: https://flarum.org/ Software Link: https://github.com/FriendsOfFlarum/pretty-mail Version: 1.1.2 Tested on: Windows XP CVE: N/A Description: The FoF Pretty...

PT-2024-18366 · WordPress · The Ultimate Gift Cards For Woocommerce

Name of the Vulnerable Software and Affected Versions: The Ultimate Gift Cards for WooCommerce – Create, Redeem & Manage Digital Gift Certificates with Personalized Templates plugin for WordPress versions up to, and including, 2.6.6 Description: The issue allows unauthenticated attackers to read...

Cross-site Scripting (XSS)

The Calendar module in Liferay Portal is vulnerable to Cross-site Scripting. The vulnerability is due to not escaping the user-supplied data in the default notification email template, which allows remote authenticated users to inject arbitrary web script or HTML via the title of a calendar event...

Liferay Portal Calendar module and Liferay DXP vulnerable to Cross-site Scripting, content spoofing

The Calendar module in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions does not escape user supplied data in the default notification email template, which allows remote...

Cross site scripting

The Calendar module in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions does not escape user supplied data in the default notification email template, which allows remote...

CVE-2024-25151

The Calendar module in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions does not escape user supplied data in the default notification email template, which allows remote...

CVE-2024-25151

CVE-2024-25151 affects Liferay Portal 7.2.0–7.4.2 and Liferay DXP 7.3 before SP3, 7.2 before FP15, and older versions. The Calendar module does not escape user-supplied data in the default notification email template, enabling remote authenticated users to inject script/HTML via the calendar even...

CVE-2024-23761

Server Side Template Injection in Gambio 4.9.2.0 allows attackers to run arbitrary code via crafted smarty email template...

Sql injection

Server Side Template Injection in Gambio 4.9.2.0 allows attackers to run arbitrary code via crafted smarty email template...

CVE-2024-23761

CVE-2024-23761 affects Gambio, specifically version 4.9.2.0 (and prior per CNNVD/CNNVD-like sources), where a Server Side Template Injection via a crafted smarty email template allows an attacker to execute arbitrary code. The issue is described consistently across Red Hat, NVD, CVE listings, and...

CVE-2024-23761

Server Side Template Injection in Gambio 4.9.2.0 allows attackers to run arbitrary code via crafted smarty email template...

Gambio Code Issue Vulnerability

Gambio is an all-in-one e-commerce solution from Gambio, Inc. A code issue vulnerability exists in Gambio 4.9.2.0 and prior versions that stems from allowing an attacker to run arbitrary code via a crafted smarty email template...

CVE-2024-0601

A vulnerability was found in ZhongFuCheng3y Austin 1.0. It has been rated as critical. Affected by this issue is the function getRemoteUrl2File of the file src\main\java\com\java3y\austin\support\utils\AustinFileUtils.java of the component Email Message Template Handler. The manipulation leads to...