CVE-2024-28114: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Peering Manager is a BGP session management tool. There is a Server Side Template Injection vulnerability that leads to Remote Code Execution in Peering Manager =1.8.2. As a result arbitrary commands can be executed on the operating system that is running Peering Manager. This issue has been...

CMS Made Simple <= 2.2.20 Multiple Vulnerabilities

CMS Made Simple is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:cmsmadesimple:cmsmadesimple...

Sql injection

CMS Made Simple version 2.2.19 is vulnerable to Server-Side Template Injection SSTI. The vulnerability exists within the Design Manager, particularly when editing the Breadcrumbs...

CVE-2024-27623: Improper Neutralization of Special Elements Used in a Template Engine

CMS Made Simple version 2.2.19 is vulnerable to Server-Side Template Injection SSTI. The vulnerability exists within the Design Manager, particularly when editing the Breadcrumbs...

CVE-2024-27623

CMS Made Simple version 2.2.19 is vulnerable to Server-Side Template Injection SSTI. The vulnerability exists within the Design Manager, particularly when editing the Breadcrumbs...

PT-2024-21973

Name of the Vulnerable Software and Affected Versions CMS Made Simple version 2.2.19 Description The issue is related to Server-Side Template Injection SSTI within the Design Manager, specifically when editing the Breadcrumbs. Recommendations For CMS Made Simple version 2.2.19, consider disabling...

livehelperchat Server-Side Template Injection

Server-Side Template Injection SSTI vulnerability in livehelperchat before 4.34, allows remote attackers to execute arbitrary code and obtain sensitive information via the search parameter in lhcweb/modules/lhfaq/faqweight.php...

GHSA-V4CP-2Q7V-HG9Q livehelperchat Server-Side Template Injection

Server-Side Template Injection SSTI vulnerability in livehelperchat before 4.34, allows remote attackers to execute arbitrary code and obtain sensitive information via the search parameter in lhcweb/modules/lhfaq/faqweight.php...

CVE-2024-27516

Server-Side Template Injection SSTI vulnerability in livehelperchat before 4.34v, allows remote attackers to execute arbitrary code and obtain sensitive information via the search parameter in lhcweb/modules/lhfaq/faqweight.php...

Sql injection

livehelperchat 4.28v is vulnerable to Server-Side Template Injection SSTI...

CVE-2024-27516

A Server-Side Template Injection (SSTI) vulnerability exists in livehelperchat versions prior to 4.34 . Remote attackers can exploit the search parameter in the lhc_web/modules/lhfaq/faqweight.php file to execute arbitrary code and obtain sensitive information. To remediate this issue, users shou...

CVE-2024-27516

Server-Side Template Injection SSTI vulnerability in livehelperchat before 4.34v, allows remote attackers to execute arbitrary code and obtain sensitive information via the search parameter in lhcweb/modules/lhfaq/faqweight.php...

CMS Made Simple 2.2.19 Server-Side Template Injection

Exploit Title: CMS Made Simple Version: 2.2.19 - SSTI Date: 2024-21-02 Exploit Author: tmrswrr Vendor Homepage: https://www.cmsmadesimple.org/ Version: 2.2.19 Tested on: https://www.softaculous.com/demos/CMSMadeSimple 1 log in as admin and go to Layout Design Manager Breadcrumbs 2 Click edit and...

CMS Made Simple 2.2.19 Server-Side Template Injection Vulnerability

Exploit Title: CMS Made Simple Version: 2.2.19 - SSTI Exploit Author: tmrswrr Vendor Homepage: https://www.cmsmadesimple.org/ Version: 2.2.19 Tested on: https://www.softaculous.com/demos/CMSMadeSimple 1 log in as admin and go to Layout Design Manager Breadcrumbs 2 Click edit and write SSTI payloa...

CVE-2024-23761

Server Side Template Injection in Gambio 4.9.2.0 allows attackers to run arbitrary code via crafted smarty email template...

CVE-2024-23761

Server Side Template Injection in Gambio 4.9.2.0 allows attackers to run arbitrary code via crafted smarty email template...

CVE-2024-23761: Server-Side Request Forgery (SSRF)

Server Side Template Injection in Gambio 4.9.2.0 allows attackers to run arbitrary code via crafted smarty email template...

CVE-2024-23761

CVE-2024-23761 affects Gambio, specifically version 4.9.2.0 (and prior per CNNVD/CNNVD-like sources), where a Server Side Template Injection via a crafted smarty email template allows an attacker to execute arbitrary code. The issue is described consistently across Red Hat, NVD, CVE listings, and...

PT-2024-5841

Name of the Vulnerable Software and Affected Versions WPML versions up to, and including, 4.6.12 Description The WPML plugin for WordPress is vulnerable to Remote Code Execution via the Twig Server-Side Template Injection. This is due to missing input validation and sanitization on the render...

PT-2024-4060 · Unknown · Irisevtxmodule

Name of the Vulnerable Software and Affected Versions: IrisEVTXModule versions prior to 1.0.0 Description: The issue is related to the incorrect restriction of the directory path name with limited access in the IrisEVTXModule, which handles Microsoft EVTX log files. This can lead to remote code...