Form-Tools-3.1.1-RCE

Form-Tools-3.1.1-RCE CVE-2024-22722：Python による SSTI 自動化を介した RCE。 Form Tools 3.1.1 の Server Side Template Injection SSTI の脆弱性により、攻撃者はアプリケーションの add forms セクションにある Group Name フィールドを介して任意のコマンドを実行できます。このスクリプトは、新しいフォームとグループの作成を自動化し、Group Name を変更して実行されたコマンド結果を返すことで、シェル風のインターフェースを提供します。...

CVE-2023-40812

OpenCRX version 5.2.0 is vulnerable to HTML injection via the Accounts Group Name Field...

EUVD-2020-29001

Malware in sbrugna...

EUVD-2023-42123

Malicious code in bioql PyPI...

EUVD-2025-29211

Malicious code in bioql PyPI...

EUVD-2023-2861

Malicious code in bioql PyPI...

CVE-2025-52344

Multiple Cross Site Scripting XSS vulnerabilities in input fields in Explorance Blue 8.1.2 allows attackers to inject arbitrary JavaScript code on the user's browser via the Group name and Project Description input fields...

CVE-2025-52344

Multiple Cross Site Scripting XSS vulnerabilities in input fields in Explorance Blue 8.1.2 allows attackers to inject arbitrary JavaScript code on the user's browser via the Group name and Project Description input fields...

PT-2025-37729

Name of the Vulnerable Software and Affected Versions Explorance Blue version 8.1.2 Description Explorance Blue version 8.1.2 contains multiple Cross Site Scripting XSS vulnerabilities in input fields. These vulnerabilities allow attackers to inject arbitrary JavaScript code into a user’s browser...

Exploit for Code Injection in Formtools Form_Tools

Form-Tools-3.1.1-RCE CVE-2024-22722 RCE via SSTI Automation wi...

CVE-2020-8089

Piwigo 2.10.1 is affected by stored XSS via the Group Name Field to the grouplist page...

Webmin < 2.100 Multiple Vulnerabilities

According to its self-reported version, the Webmin install hosted on the remote host is prior to 2.100. It is, therefore, affected by multiple vulnerabilities: - A Cross-Site Scripting XSS vulnerability exists in the Users Real name parameter. - A Cross-Site Scripting XSS vulnerability exists in...

Cross-site Scripting (XSS)

Overview camaleoncms is a dynamic and advanced content management system based on Ruby on Rails as an alternative to Wordpress. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the content group name field. An attacker can execute arbitrary scripts or commands by...

CVE-2024-22722

Server Side Template Injection SSTI vulnerability in Form Tools 3.1.1 allows attackers to run arbitrary commands via the Group Name field under the add forms section of the application...

CVE-2024-22722

Form Tools version 3.1.1 is vulnerable to a Server Side Template Injection (SSTI) flaw. Attackers can execute arbitrary commands by manipulating the Group Name field within the application's add forms section. This vulnerability allows for Remote Code Execution (RCE) , as evidenced by public proo...

CVE-2024-22722

Server Side Template Injection SSTI vulnerability in Form Tools 3.1.1 allows attackers to run arbitrary commands via the Group Name field under the add forms section of the application...

PT-2024-19542

Name of the Vulnerable Software and Affected Versions Form Tools version 3.1.1 Description A Server Side Template Injection SSTI issue allows attackers to run arbitrary commands via the Group Name field under the add forms section of the application. Recommendations For Form Tools version 3.1.1,...

CVE-2024-22722: Improper Control of Generation of Code

Server Side Template Injection SSTI vulnerability in Form Tools 3.1.1 allows attackers to run arbitrary commands via the Group Name field under the add forms section of the application...

Input validation

Concrete CMS version 9 before 9.2.7 is vulnerable to Stored XSS via the Name field of a Group type since there is insufficient validation of administrator provided data for that field. A rogue administrator could inject malicious code into the Name field which might be executed when users visit t...

CVE-2024-2179 Concrete CMS version 9 before 9.2.7 is vulnerable to Stored XSS via the Name field of a Group type

Concrete CMS version 9 before 9.2.7 is vulnerable to Stored XSS via the Name field of a Group type since there is insufficient validation of administrator provided data for that field. A rogue administrator could inject malicious code into the Name field which might be executed when users visit t...