cve-2023-1671

Cve-2023-1671 Cve-2023-1671（https://vulners.com/cve/CVE-2023-1671）是如何工作的？ /opt/ws/bin/ftsblistpack 是一个 Perl 脚本，它调用 /opt/ws/bin/sblistpack，这是另一个 Perl 脚本。 其中的 shell 命令参数用单引号括起来： root@kitploit: $rc += system"$sblistpack '$uri' '$user' '$filetype' '$filein' '$fileout'"; 这一点将来会很重要，它将成为导致漏洞的因素之一。...

CVE-2026-5090

Template::Plugin::HTML versions through 3.102 for Perl allows HTML and JavaScript to be injected. The htmlfilter function did not escape single quotes. HTML attributes inside of single quotes could be have code injected. For example, the variable "var" in would not be properly escaped. An attacke...

GHSA-7P85-W9PX-JPJP Twig: PHP code injection via `{% use %}` template name

Description Compiler::string escapes ", $, , NUL and TAB when generating PHP double-quoted string literals, but does not escape single quotes. In ModuleNode::compileConstructor, the template name from a % use % tag is compiled via subcompile - string and placed inside a surrounding PHP...

UBUNTU-CVE-2026-5090

Template::Plugin::HTML versions through 3.102 for Perl allows HTML and JavaScript to be injected. The htmlfilter function did not escape single quotes. HTML attributes inside of single quotes could be have code injected. For example, the variable "var" in would not be properly escaped. An attacke...

CVE-2026-5090

Template::Plugin::HTML versions through 3.102 for Perl allows HTML and JavaScript to be injected. The htmlfilter function did not escape single quotes. HTML attributes inside of single quotes could be have code injected. For example, the variable "var" in would not be properly escaped. An attacke...

PT-2023-24603 · Jstachio · Jstachio

Name of the Vulnerable Software and Affected Versions: JStachio versions prior to 1.0.1 Description: JStachio fails to escape single quotes ' in HTML, allowing an attacker to inject malicious code. This can be exploited to execute arbitrary JavaScript code in the context of other users visiting...