250 matches found
CVE-2023-26265: Improper Limitation of a Pathname to a Restricted Directory
The Borg theme before 1.1.19 for Backdrop CMS does not sufficiently sanitize path arguments that are passed in via a URL. The function borgpreprocesspage in the file template.php does not properly sanitize incoming path arguments before using them...
CVE-2023-26265
The Borg theme before 1.1.19 for Backdrop CMS does not sufficiently sanitize path arguments that are passed in via a URL. The function borgpreprocesspage in the file template.php does not properly sanitize incoming path arguments before using them...
PT-2023-20574
Name of the Vulnerable Software and Affected Versions Backdrop CMS Borg theme versions prior to 1.1.19 Description The issue arises from insufficient sanitization of path arguments passed via a URL. Specifically, the function borg preprocess page in the file template.php does not properly sanitiz...
CVE-2023-0783
A vulnerability was found in EcShop 4.1.5. It has been classified as critical. This affects an unknown part of the file /ecshop/admin/template.php of the component PHP File Handler. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been...
CVE-2023-0783: Unrestricted Upload of File with Dangerous Type
A vulnerability was found in EcShop 4.1.5. It has been classified as critical. This affects an unknown part of the file /ecshop/admin/template.php of the component PHP File Handler. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been...
Twig remote code execution in templates
The displayBlock function Template.php in Sensio Labs Twig before 1.20.0, when Sandbox mode is enabled, allows remote attackers to execute arbitrary code via the self variable in a template...
Sandbox bypass in fenom
In fenom 2.12.1 and before, there is a way in fenom/src/Fenom/Template.php function getTemplateCodeto bypass sandbox to execute arbitrary PHP code when disablenativefuncs is true...
GHSA-674V-3G2W-84GX Sandbox bypass in fenom
In fenom 2.12.1 and before, there is a way in fenom/src/Fenom/Template.php function getTemplateCodeto bypass sandbox to execute arbitrary PHP code when disablenativefuncs is true...
CVE-2021-46433
In fenom 2.12.1 and before, there is a way in fenom/src/Fenom/Template.php function getTemplateCodeto bypass sandbox to execute arbitrary PHP code when disablenativefuncs is true...
CVE-2021-46433
CVE-2021-46433 concerns Fenom (PHP template engine) up to version 2.12.1 and earlier. The vulnerability lies in fenom/src/Fenom/Template.php, function getTemplateCode(), where a sandbox bypass can occur when disable_native_funcs is true, enabling arbitrary PHP code execution. Public records acros...
CVE-2020-21654
emlog v6.0 contains a vulnerability in the component admin\template.php, which allows attackers to getshell via a crafted Zip file...
CVE-2020-21654
Affected software: emlog v6.0. Vulnerability: A flaw in the admin\template.php component allows an attacker to obtain a shell by crafting a malicious ZIP file. This is linked to improper validation of uploaded ZIPs. Impact: Remote code execution with high severity potential due to arbitrary shell...
CVE-2020-21654
emlog v6.0 contains a vulnerability in the component admin\template.php, which allows attackers to getshell via a crafted Zip file...
CVE-2020-21654: Undefined Security Weakness
emlog v6.0 contains a vulnerability in the component admin\template.php, which allows attackers to getshell via a crafted Zip file...
PT-2021-10224
Name of the Vulnerable Software and Affected Versions: ZZZCMS zzzphp version 1.7.1 Description: The issue allows remote attackers to execute arbitrary code due to a lack of parameter filtering in inc/zzz template.php. This enables attackers to inject SQL code, potentially leading to unauthorized...
Information Disclosure
johnpbloch/wordpress-core is vulnerable to information disclosure. The vulnerability exists in the getcommentexcerpt function in comment-template.php because the comments from password-protected non-public posts and pages are not restricted from viewing under certain conditions...
CVE-2020-25286
In wp-includes/comment-template.php in WordPress before 5.4.2, comments from a post or page could sometimes be seen in the latest comments even if the post or page was not public...
CVE-2020-25286: Undefined Security Weakness
In wp-includes/comment-template.php in WordPress before 5.4.2, comments from a post or page could sometimes be seen in the latest comments even if the post or page was not public...
