17372 matches found
Exploit for CVE-2026-12227
CVE-2026-12227 — Visual Composer Website Builder Unauthenticat...
CVE-2026-97359
HFS2 version 2.4.0 and earlier contains a template injection vulnerability in the multipart upload handler that allows unauthenticated attackers to achieve remote code execution by embedding malicious template syntax in a filename. Attackers can craft a filename containing a closing template...
CVE-2026-97360
HFS2 version 2.4.0 and earlier contains an unauthenticated arbitrary file access vulnerability that allows unauthenticated attackers to read, write, append, and delete files anywhere the HFS service account has filesystem access outside the shared folder. Attackers can exploit the macro...
CVE-2026-97360 HFS2 2.4.0 Unauthenticated Arbitrary File Read/Write via Template Engine
HFS2 version 2.4.0 and earlier contains an unauthenticated arbitrary file access vulnerability that allows unauthenticated attackers to read, write, append, and delete files anywhere the HFS service account has filesystem access outside the shared folder. Attackers can exploit the macro...
CVE-2026-97360
HFS2 version 2.4.0 and earlier is vulnerable to an unauthenticated arbitrary file access flaw. The root cause is the macro dispatcher's lack of an authorization model combined with a path resolver that fails to confine absolute paths. Attackers can exploit this to manipulate the template engine ,...
CVE-2026-97360 HFS2 2.4.0 Unauthenticated Arbitrary File Read/Write via Template Engine
HFS2 version 2.4.0 and earlier contains an unauthenticated arbitrary file access vulnerability that allows unauthenticated attackers to read, write, append, and delete files anywhere the HFS service account has filesystem access outside the shared folder. Attackers can exploit the macro...
CVE-2026-97359 HFS2 2.4.0 RCE via Multipart Upload Filename Template Injection
HFS2 version 2.4.0 and earlier contains a template injection vulnerability in the multipart upload handler that allows unauthenticated attackers to achieve remote code execution by embedding malicious template syntax in a filename. Attackers can craft a filename containing a closing template...
EUVD-2026-85879
HFS2 version 2.4.0 and earlier contains a template injection vulnerability in the multipart upload handler that allows unauthenticated attackers to achieve remote code execution by embedding malicious template syntax in a filename. Attackers can craft a filename containing a closing template...
CVE-2026-97359 HFS2 2.4.0 RCE via Multipart Upload Filename Template Injection
HFS2 version 2.4.0 and earlier contains a template injection vulnerability in the multipart upload handler that allows unauthenticated attackers to achieve remote code execution by embedding malicious template syntax in a filename. Attackers can craft a filename containing a closing template...
CVE-2026-97359
HFS2 version 2.4.0 and earlier are vulnerable to a template injection flaw within the multipart upload handler . Unauthenticated attackers can achieve remote code execution (RCE) on the underlying host system by crafting a filename containing a closing template quoting sequence followed by an exe...
html/template: golang: Go html/template: Cross-Site Scripting via pathological input
A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...
CVE-2026-12227
The Visual Composer Website Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 45.16.0 via the vcv-template parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the...
CVE-2026-12227
The Visual Composer Website Builder plugin for WordPress is vulnerable to Local File Inclusion (LFI) in all versions up to and including 45.16.0 . The flaw exists within the vcv-template parameter, which allows unauthenticated attackers to include and execute arbitrary files on the server. This c...
CVE-2026-12227 Visual Composer Website Builder <= 45.16.0 - Unauthenticated Local File Inclusion via 'vcv-template' Parameter
The Visual Composer Website Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 45.16.0 via the vcv-template parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the...
EUVD-2026-85839
The Visual Composer Website Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 45.16.0 via the vcv-template parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the...
WordPress Template Kit – Import plugin <= 1.0.16 - Arbitrary File Deletion vulnerability
Arbitrary File Deletion vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Template Kit – Import versions = 1.0.16...
CVE-2026-88843
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not validate one of its display-style settings before using it to build a template path, allowing users with the Contributor role and above to include and execute arbitrary local PHP files on the server. An equivalent path w...
EUVD-2026-85801
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not validate one of its display-style settings before using it to build a template path, allowing users with the Contributor role and above to include and execute arbitrary local PHP files on the server. An equivalent path w...
Important: Red Hat Security Advisory: buildah security update
An update for buildah is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...
html/template: golang: Go html/template: Cross-Site Scripting via pathological input
A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...