CVE-2024-12140 Elementor AI Addons – 70 Widgets, Premium Templates, Ultimate Elements <= 2.2.1 - Authenticated (Contributor+) Private Templates Content Disclosure

The Elementor Addons AI Addons – 70 Widgets, Premium Templates, Ultimate Elements plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.2.1 via the render function due to insufficient restrictions on which templates can be included. This makes it...

CVE-2024-12140

The CVE-2024-12140 incident concerns the WordPress plugin Elementor Addons AI Addons (70 Widgets, Premium Templates, Ultimate Elements). Affected component: render function in versions up to and including 2.2.1. Root cause: insufficient restrictions on which templates can be included, enabling in...

CVE-2024-12140 Elementor AI Addons – 70 Widgets, Premium Templates, Ultimate Elements <= 2.2.1 - Authenticated (Contributor+) Private Templates Content Disclosure

The Elementor Addons AI Addons – 70 Widgets, Premium Templates, Ultimate Elements plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.2.1 via the render function due to insufficient restrictions on which templates can be included. This makes it...

PT-2025-1762 · WordPress · Elementor Addons Ai Addons

Name of the Vulnerable Software and Affected Versions: Elementor Addons AI Addons – 70 Widgets, Premium Templates, Ultimate Elements plugin for WordPress versions up to, and including, 2.2.1 Description: The issue concerns insufficient restrictions on which templates can be included through the...

CVE-2024-54767

creationtimestamp| type| source ---|---|--- 2025-01-06 22:37:06+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/263 2025-01-06 23:15:34+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lf4bb4ufpf2o 2025-01-06 23:37:48+00:00| seen|...

USN-7140-2 tinyproxy vulnerability

USN-7140-1 fixed CVE-2022-40468 in tinyproxy. This update provides the corresponding update for Ubuntu 14.04 LTS. Original advisory details: It was discovered that Tinyproxy did not properly manage memory under certain circumstances. An attacker could possibly use this issue to leak left-over hea...

OESA-2025-1004 python-jinja2 security update

Jinja2 is one of the most used template engines for Python. It is inspired by Django's templating system but extends it with an expressive language that gives template authors a more powerful set of tools. On top of that it adds sandboxed execution and optional automatic escaping for applications...

BREACH Attack

Varnish VCL templates are vulnerable to the BREACH vulnerability. The vulnerability is due to improper handling of HTTP compression, allowing secrets to be extracted through carefully crafted requests...

CVE-2024-56241

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in wpkoithemes WPKoi Templates for Elementor wpkoi-templates-for-elementor allows Stored XSS.This issue affects WPKoi Templates for Elementor: from n/a through = 3.1.3...

CVE-2024-56241 WordPress WPKoi Templates for Elementor plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in wpkoithemes WPKoi Templates for Elementor wpkoi-templates-for-elementor allows Stored XSS.This issue affects WPKoi Templates for Elementor: from n/a through = 3.1.3...

CVE-2024-56241

CVE-2024-56241 concerns wpkoithemes WPKoi Templates for Elementor (plugin: WPKoi Templates for Elementor). The vulnerability is a Stored XSS in the template output caused by insufficient input neutralization during web page generation (Improper Neutralization of Input During Web Page Generation)....

PT-2025-3207 · Unknown · Wpkoi Templates For Elementor

Name of the Vulnerable Software and Affected Versions: WPKoi Templates for Elementor versions 3.1.3 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Stored XSS. This enables potential attacke...

WordPress plugin WPKoi Templates for Elementor 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site...

WordPress WPKoi Templates for Elementor plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin WPKoi Templates for Elementor versions = 3.1.3...

OESA-2024-2582 podman security update

Podman manages the entire container ecosystem which includes pods, containers, container images, and container volumes using the libpod library. Security Fixes: Templates do not properly consider backticks as Javascript string delimiters, and do not escape them as expected. Backticks are used,...

SUSE CVE-2024-56201

Jinja is an extensible templating engine. In versions on the 3.x branch prior to 3.1.5, a bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regardless of if Jinja's sandbox is used. To exploit the vulnerability...

GHSA-Q2X7-8RV6-6Q7H Jinja has a sandbox breakout through indirect reference to format method

An oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on th...

Jinja has a sandbox breakout through indirect reference to format method

An oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on th...

Jinja has a sandbox breakout through malicious filenames

A bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regardless of if Jinja's sandbox is used. To exploit the vulnerability, an attacker needs to control both the filename and the contents of a template. Whether...

Improper Neutralization of Server-Side Includes (SSI) Within a Web Page

Overview aptrs is an Automated Penetration Testing Reporting System Affected versions of this package are vulnerable to Improper Neutralization of Server-Side Includes SSI Within a Web Page in the web application's handling of user-supplied input in the ckeditor fields that are passed directly to...