MAL-2025-1124 Malicious code in flow-templates (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 95e93dd23f522075c8f46757a65625424d8ca39a6ecf846cc72b5eef35225347 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in cs-templates (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0b2190818daf8cbe7ca369cf5eb1bcb74bdd542a4295ee61af7c6ef4617bf0ce Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1090 Malicious code in cs-templates (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0b2190818daf8cbe7ca369cf5eb1bcb74bdd542a4295ee61af7c6ef4617bf0ce Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in cs-templates-vue3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b7eab2131a229bf433f5924ee12b5bd1e1e393c31b3027c28aecb5a187057d23 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1091 Malicious code in cs-templates-vue3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b7eab2131a229bf433f5924ee12b5bd1e1e393c31b3027c28aecb5a187057d23 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

jinja2: Jinja has a sandbox breakout through indirect reference to format method

A flaw was found in the Jinja package. In affected versions of Jinja, an oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to...

The vulnerability in the host_templates.php script of the Cacti network monitoring software allows a hacker to execute arbitrary code.

The vulnerability of the hosttemplates.php script of the Cacti network monitoring software is related to the lack of security measures for the SQL query structure. Exploiting this vulnerability allows an attacker who operates remotely to execute arbitrary code...

WordPress plugin BP Email Assign Templates 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

The vulnerability of the Gstreamer multimedia framework, related to integer overflow, allows an attacker to execute arbitrary code.

The vulnerability of the Gstreamer multimedia framework is related to a potential overflow condition in the parser that processes MP4/MOV demultiplexer templates. Exploiting this vulnerability allows an attacker to execute arbitrary code...

PT-2025-5459 · Unknown · Philopress Bp Email Assign Templates

Name of the Vulnerable Software and Affected Versions: PhiloPress BP Email Assign Templates versions n/a through 1.5 Description: The issue is related to improper neutralization of input during web page generation, also known as 'Cross-site Scripting', which allows Reflected XSS. This problem...

jinja2: Jinja has a sandbox breakout through indirect reference to format method

A flaw was found in the Jinja package. In affected versions of Jinja, an oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to...

WordPress Starter Templates by FancyWP plugin <= 2.0.0 - Unauthenticated Blind Server-Side Request Forgery vulnerability

Unauthenticated Blind Server-Side Request Forgery vulnerability discovered by Francesco Carlucci in WordPress Plugin Starter Templates by FancyWP versions = 2.0.0...

CVE-2024-8494

The Elementor Website Builder Pro plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.25.10 via the 'elementor-template' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract...

CVE-2024-12102 Typer Core <= 1.9.6 - Authenticated (Contributor+) Post Disclosure

The Typer Core plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.9.6 via the 'elementor-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level...

WordPress plugin Elementor Website Builder Pro 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A security vulnerability...

PT-2025-3701 · WordPress · Elementor Website Builder

Name of the Vulnerable Software and Affected Versions: Elementor Website Builder Pro plugin for WordPress versions prior to 3.25.11 Description: The issue allows authenticated attackers with Contributor-level access and above to extract sensitive data, including the content of Private, Pending, a...

jinja2: Jinja has a sandbox breakout through malicious filenames

A flaw was found in the Jinja2 package. A bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regardless of Jinja's sandbox being used. An attacker needs to be able to control both the filename and the contents o...

jinja2: Jinja has a sandbox breakout through indirect reference to format method

A flaw was found in the Jinja package. In affected versions of Jinja, an oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to...

jinja2: Jinja has a sandbox breakout through indirect reference to format method

A flaw was found in the Jinja package. In affected versions of Jinja, an oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to...

SUSE CVE-2024-54146

Cacti is an open source performance and fault management framework. Cacti has a SQL injection vulnerability in the template function of hosttemplates.php using the graphtemplate parameter. This vulnerability is fixed in 1.2.29...