EUVD-2021-12189

Malware in sbrugna...

Linux Distros Unpatched Vulnerability : CVE-2023-39514

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting XSS Vulnerability...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the FreeMarker template processing when following redirects. An attacker can make unauthorized network requests by submitting crafted URLs. Note: Exploiting this vulnerability requires template edito...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the FreeMarker template processing when following redirects. An attacker can make unauthorized network requests by submitting crafted URLs. Note: Exploiting this vulnerability requires template edito...

CVE-2025-50233

A vulnerability in QCMS version 6.0.5 allows authenticated users to read arbitrary files from the server due to insufficient validation of the "Name" parameter in the backend template editor. By manipulating the parameter, attackers can perform directory traversal and access sensitive files outsi...

PT-2025-32178 · Qcms · Qcms

Name of the Vulnerable Software and Affected Versions: QCMS version 6.0.5 Description: A vulnerability allows authenticated users to read arbitrary files from the server due to insufficient validation of the Name parameter in the backend template editor. Attackers can manipulate this parameter to...

QCMS 安全漏洞

Velvet Ease Technology QCMS is an open source content management system CMS for creating responsive websites from China's Velvet Ease Technology. A security vulnerability exists in QCMS version 6.0.5, which stems from insufficient validation of the Name parameter in the back-end template editor,...

CVE-2025-50233

QCMS 6.0.5 contains a vulnerability in the backend template editor where insufficient validation of the Name parameter enables authenticated users to perform directory traversal and read arbitrary server files outside the intended template directory (e.g., system configuration or PHP source). Imp...

Exploit for CVE-2025-50754

CVE-2025-50754 Stored XSS to Remote Code Execution in a PHP-...

CVE-2021-25278

FTAPI 4.0 through 4.10 allows XSS via an SVG document to the Background Image upload feature in the Submit Box Template Editor...

CVE-2020-25287

Pligg 2.0.3 allows remote authenticated users to execute arbitrary commands because the template editor can edit any file, as demonstrated by an admin/admineditor.php thefile=..%2Findex.php=Open request...

cve

Vulnerability Title: Arbitrary File Read in QCMS Authenticate...

Tailoring Management System SQL Injection Vulnerability

Tailoring Management System is a tailoring management system from itsourcecode open source. SQL injection vulnerability exists in itsourcecode Tailoring Management System version 1.0, which originates from the parameter id/title/msg in the file templateEditor.php and can lead to SQL injection...

Cacti Import Packages RCE

This exploit module leverages an arbitrary file write vulnerability CVE-2024-25641 in Cacti versions prior to 1.2.27 to achieve RCE. It abuses the Import Packages feature to upload a specially crafted package that embeds a PHP file. Cacti will extract this file to an accessible location. The modu...

CVE-2023-39513

Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting XSS Vulnerability which allows an authenticated user to poison data stored in the cacti's database. These data will be viewed by administrative cacti...

CVE-2021-25278

FTAPI 4.0 through 4.10 allows XSS via an SVG document to the Background Image upload feature in the Submit Box Template Editor...

CVE-2021-25278

FTAPI 4.0 through 4.10 allows XSS via an SVG document to the Background Image upload feature in the Submit Box Template Editor...

CVE-2021-25278

FTAPI 4.0 through 4.10 allows XSS via an SVG document to the Background Image upload feature in the Submit Box Template Editor...

Design/Logic Flaw

FTAPI 4.0 through 4.10 allows XSS via an SVG document to the Background Image upload feature in the Submit Box Template Editor...

CVE-2021-25278

The FTAPI vulnerability CVE-2021-25278 affects FTAPI versions 4.0–4.10 and is a cross-site scripting flaw in the Background Image upload feature of the Submit Box Template Editor. An attacker can exploit the issue by uploading an SVG file containing embedded JavaScript, which may compromise a vic...