Virtualmin Cross-Site Scripting Vulnerability

Virtualmin is a powerful and flexible web hosting control panel for Linux and BSD systems from Virtualmin. A security vulnerability exists in Virtualmin version 7.7 that stems from a cross-site scripting XSS vulnerability in the Server Templates feature...

CVE-2023-47097

A Stored Cross-Site Scripting XSS vulnerability in the Server Template under System Setting in Virtualmin 7.7 allows remote attackers to inject arbitrary web script or HTML via the Template name field while creating server templates...

PT-2023-30305 · Unknown · Virtualmin

Name of the Vulnerable Software and Affected Versions: Virtualmin version 7.7 Description: A Stored Cross-Site Scripting XSS issue in the Server Template under System Setting in Virtualmin allows remote attackers to inject arbitrary web script or HTML via the Template name field while creating...

PT-2023-29925 · Kimai · Kimai

Name of the Vulnerable Software and Affected Versions: Kimai versions prior to 2.1.0 Description: Kimai, a web-based multi-user time-tracking application, is vulnerable to a Server-Side Template Injection SSTI which can be escalated to Remote Code Execution RCE. The vulnerability arises when a...

CVE-2023-46194

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Eric Teubert Archivist – Custom Archive Templates plugin = 1.7.5 versions...

Cross site scripting

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Eric Teubert Archivist – Custom Archive Templates plugin = 1.7.5 versions...

CVE-2023-46194

CVE-2023-46194 – Unauthenticated Reflected XSS in Archivist – Custom Archive Templates (WordPress)

CVE-2023-46194 WordPress Archivist – Custom Archive Templates Plugin <= 1.7.5 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Eric Teubert Archivist – Custom Archive Templates plugin = 1.7.5 versions...

CVE-2023-46194 WordPress Archivist – Custom Archive Templates Plugin <= 1.7.5 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Eric Teubert Archivist – Custom Archive Templates plugin = 1.7.5 versions...

Archivist – Custom Archive Templates <= 1.7.5 - Reflected XSS

Description The plugin does not sanitise and escape some parameters before outputting them back in the page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

The vulnerability of the software interface for coordinating the operation of cybersecurity systems and for managing real-time incident responses in Fortinet FortiSOAR allows a perpetrator to execute arbitrary code.

The vulnerability of the software interface for coordinating the operation of cybersecurity systems and for managing real-time incident responses in Fortinet FortiSOAR is related to errors in eliminating special elements within the template creation mechanism. Exploiting this vulnerability allows...

GHSA-QCJ9-GCPG-4W2W XWiki Platform web templates vulnerable to reflected XSS in the create document form if name validation is enabled

Impact When document names are validated according to a name strategy disabled by default, XWiki is vulnerable to a reflected XSS attack in the page creation form. To reproduce, make sure that "Validate names before saving" is enabled in the administration under "Editing" - "Name strategies" and...

Royal Elementor Addons and Templates Plugin for WordPress < 1.3.79 Arbitrary File Upload

The WordPress Royal Elementor Addons and Templates Plugin installed on the remote host is affected by a file upload vulnerability. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. No source data...

The vulnerability of the Royal Elementor Addons and Templates plugin of the WordPress content management system allows a hacker to execute arbitrary code by loading a specially created file.

The vulnerability of the Royal Elementor Addons and Templates plugin of the WordPress content management system is related to the ability to download files of a dangerous type without limitation. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code by downloading ...

foreman: OS command injection via ct_command and fcct_command

A command injection flaw was found in foreman. This flaw allows an authenticated user with admin privileges on the foreman instance to transpile commands through CoreOS and Fedora CoreOS configurations in templates, possibly resulting in arbitrary command execution on the underlying operating...

WordPress Archivist – Custom Archive Templates Plugin <= 1.7.7 is vulnerable to Cross Site Scripting (XSS)

Software Archivist – Custom Archive Templates Type Plugin Vulnerable versions = 1.7.7 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-46194 Patch priority Medium CVSS severity Medium 5.8 Developer Claim ownership PSID 9eaf34517c88 Credit...

CVE-2023-34207

Unrestricted upload of file with dangerous type vulnerability in create template function in EasyUse MailHunter Ultimate 2023 and earlier allows remote authenticated users to perform arbitrary system commands with ‘NT Authority\SYSTEM‘ privilege via a crafted ZIP archive...

CVE-2023-4666

creationtimestamp| type| source ---|---|--- 2023-10-17 00:32:14+00:00| seen| https://t.me/cibsecurity/72347 2025-01-31 21:40:22+00:00| seen| Telegram/KQt3AsBMUv9rm4uNMEtvLFjsfOosJKxmDQL0jQWpInK2LtGCng 2025-04-07 11:02:22+00:00| published-proof-of-concept| https://t.me/Idi0tSecMarket/21 2025-09-24...

Remote Code Execution (RCE)

cachethq/cachet is vulnerable to Remote Code Execution RCE. The vulnerability is caused by a flaw in the way Cachet handles twig templates. An attacker is able to exploit this flaw by injecting malicious code into a template, which will then be executed when the template is rendered...

CVE-2023-29453

Templates do not properly consider backticks as Javascript string delimiters, and do not escape them as expected. Backticks are used, since ES6, for JS template literals. If a template contains a Go template action within a Javascript template literal, the contents of the action can be used to...