190 matches found
CVE-2026-67612 OpenEMR 8.2.0 Stored XSS via import_template.php Template Management
OpenEMR through 8.2.0 contains a stored cross-site scripting vulnerability in the patient portal template system that allows authenticated administrators to inject arbitrary HTML and JavaScript by storing malicious payloads through the template save mode, which only filters literal PHP open tags...
CVE-2026-67612
OpenEMR 8.2.0 contains a stored XSS vulnerability in the patient portal template system (import_template.php, Template Management). The root cause is stored payloads in the template save mode, which only filters literal PHP open tags, coupled with lack of output encoding at retrieval and missing ...
PT-2026-61662
Name of the Vulnerable Software and Affected Versions Mettle SendPortal versions prior to 3.0.2 Description A stored cross-site scripting XSS issue exists in the template management functionality. The application does not properly sanitize user-supplied input in the content parameter of the...
CVE-2026-33733 EspoCRM has Admin TemplateManager path traversal that allows arbitrary file read write and delete
EspoCRM is an open source customer relationship management application. Prior to version 9.3.4, the admin template management endpoints accept attacker-controlled name and scope values and pass them into template path construction without normalization or traversal filtering. As a result, an...
CVE-2026-4124
The Ziggeo plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.1.1. The wpajaxziggeoajax handler only verifies a nonce checkajaxreferer but performs no capability checks via currentusercan. Furthermore, the nonce 'ziggeoajaxnonce' is exposed to all...
CVE-2025-15589
A vulnerability was determined in MuYuCMS 2.7. Affected is the function deletedirfile of the file application/admin/controller/Template.php of the component Template Management Page. This manipulation of the argument temn/tp causes path traversal. It is possible to initiate the attack remotely. T...
CVE-2025-15589
A vulnerability was determined in MuYuCMS 2.7. Affected is the function deletedirfile of the file application/admin/controller/Template.php of the component Template Management Page. This manipulation of the argument temn/tp causes path traversal. It is possible to initiate the attack remotely. T...
CVE-2025-15589
A vulnerability was determined in MuYuCMS 2.7. Affected is the function deletedirfile of the file application/admin/controller/Template.php of the component Template Management Page. This manipulation of the argument temn/tp causes path traversal. It is possible to initiate the attack remotely. T...
CVE-2025-15589 MuYuCMS Template Management Template.php delete_dir_file path traversal
A vulnerability was determined in MuYuCMS 2.7. Affected is the function deletedirfile of the file application/admin/controller/Template.php of the component Template Management Page. This manipulation of the argument temn/tp causes path traversal. It is possible to initiate the attack remotely. T...
EUVD-2025-207549
A vulnerability was determined in MuYuCMS 2.7. Affected is the function deletedirfile of the file application/admin/controller/Template.php of the component Template Management Page. This manipulation of the argument temn/tp causes path traversal. It is possible to initiate the attack remotely. T...
CVE-2025-15589
MuYuCMS 2.7 is affected by a path traversal in Template Management Page’s delete_dir_file function (application/admin/controller/Template.php). The issue arises from manipulating the temn/tp argument, enabling remote exploitation. Multiple sources (NVD, Red Hat, CVE records) confirm that an explo...
CVE-2025-15589
A vulnerability was determined in MuYuCMS 2.7. Affected is the function deletedirfile of the file application/admin/controller/Template.php of the component Template Management Page. This manipulation of the argument temn/tp causes path traversal. It is possible to initiate the attack remotely. T...
CVE-2025-15589 MuYuCMS Template Management Template.php delete_dir_file path traversal
A vulnerability was determined in MuYuCMS 2.7. Affected is the function deletedirfile of the file application/admin/controller/Template.php of the component Template Management Page. This manipulation of the argument temn/tp causes path traversal. It is possible to initiate the attack remotely. T...
PT-2026-21666
A vulnerability was determined in MuYuCMS 2.7. Affected is the function delete dir file of the file application/admin/controller/Template.php of the component Template Management Page. This manipulation of the argument temn/tp causes path traversal. It is possible to initiate the attack remotely...
Catalyst 操作系统命令注入漏洞
Catalyst is a web application framework developed by karutoil’s developers. Catalyst has a vulnerability related to operating system command injection. This vulnerability stems from the installation scripts defined in the server templates, which execute directly on the host operating system with...
CVE-2026-1111 Sanluan PublicCMS Task Template Management TaskTemplateAdminController.java save path traversal
A vulnerability has been found in Sanluan PublicCMS up to 5.202506.d. This impacts the function Save of the file com/publiccms/controller/admin/sys/TaskTemplateAdminController.java of the component Task Template Management Handler. Such manipulation of the argument path leads to path traversal. T...
CVE-2026-1111
Summary: CVE-2026-1111 affects Sanluan PublicCMS, version pre-5.202506.d, via path traversal in the Save function of TaskTemplateAdminController.java (com/publiccms/controller/admin/sys/TaskTemplateAdminController.java, Task Template Management Handler). The vulnerability arises from manipulation...
CVE-2026-1111
A vulnerability has been found in Sanluan PublicCMS up to 5.202506.d. This impacts the function Save of the file com/publiccms/controller/admin/sys/TaskTemplateAdminController.java of the component Task Template Management Handler. Such manipulation of the argument path leads to path traversal. T...
PublicCMS path traversal vulnerability
PublicCMS is an open-source content management system CMS developed by PublicCMS Company in China, written in the Java language. Versions of PublicCMS 5.202506.d and earlier have a path traversal vulnerability. This vulnerability stems from incorrect handling of the path parameter in the function...