BITB - Browser In The Browser (BITB) Templates

Browser templates for Browser In The Browser BITB attack. More information: https://mrd0x.com/browser-in-the-browser-phishing-attack/ Usage Each folder has a index.html file which has 4 variables that must be modified: XX-TITLE-XX - The title that shows up for the page e.g. Sign in to your accoun...

CVE-2022-27984

CuppaCMS v1.0 was discovered to contain a SQL injection vulnerability via the menufilter parameter at /administrator/templates/default/html/windows/right.php...

CVE-2022-27984

CuppaCMS v1.0 was discovered to contain a SQL injection vulnerability via the menufilter parameter at /administrator/templates/default/html/windows/right.php...

CVE-2022-27984

CuppaCMS v1.0 was discovered to contain a SQL injection vulnerability via the menufilter parameter at /administrator/templates/default/html/windows/right.php...

CVE-2022-27984

CuppaCMS v1.0 was discovered to contain a SQL injection vulnerability via the menufilter parameter at /administrator/templates/default/html/windows/right.php...

ejs template injection vulnerability

The ejs aka Embedded JavaScript templates package 3.1.6 for Node.js allows server-side template injection in settingsview optionsoutputFunctionName. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command which is executed upon template...

Ballcat Codegen 输入验证错误漏洞

BallCat Codegen is a code generator for BallCat. A security vulnerability exists in Ballcat Codegen that allows an attacker to achieve remote code execution via malicious code injection from the template engine. This occurs due to the introduction of Velocity and freemarker templates without...

DEBIAN-CVE-2022-29078

The ejs aka Embedded JavaScript templates package 3.1.6 for Node.js allows server-side template injection in settingsview optionsoutputFunctionName. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command which is executed upon template...

UBUNTU-CVE-2022-29078

The ejs aka Embedded JavaScript templates package 3.1.6 for Node.js allows server-side template injection in settingsview optionsoutputFunctionName. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command which is executed upon template...

CVE-2022-29078

CVE-2022-29078 affects Node.js ejs, version 3.1.6. The vulnerability is a server-side template injection in settings[view options][outputFunctionName], where input is parsed as an internal option and can overwrite outputFunctionName to execute an arbitrary OS command during template compilation. ...

nuclei-templates

This repository is a collection of community-curated templates for the nuclei engine to find security vulnerabilities in applications. The templates are stored in the cves/ directory and are used by the nuclei scanner to identify potential vulnerabilities. The repository also contains workflows f...

CVE-2022-0879

creationtimestamp| type| source ---|---|--- 2022-04-18 22:23:55+00:00| seen| https://t.me/cibsecurity/41066 2025-12-03 01:11:15+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2022/CVE-2022-0879.yaml 2025-12-03 21:02:28+00:00| seen|...

nuclei-templates

This repository is an offensive tool for nuclei templates. It contains a collection of community-curated templates for the nuclei engine to find security vulnerabilities in applications. The templates are stored in the cves directory and are used by the nuclei scanner to identify potential...

Wordpress plugin Yooslider Yoo Slider cross-site request forgery vulnerability

WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site request forgery vulnerability exists in Wordpress plugin Yooslider Yoo Slider 2.0.0 and earlier, which can be exploited by attackers ...

CVE-2022-27847

Cross-Site Request Forgery CSRF vulnerability in Yooslider Yoo Slider = 2.0.0 on WordPress allows attackers to import templates...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in Yooslider Yoo Slider = 2.0.0 on WordPress allows attackers to import templates...

The vulnerability of PHP Smarty template handlers relates to improper code generation during the processing of invalid function names, allowing attackers to execute arbitrary code.

The vulnerability of PHP Smarty templates relates to improper handling of code generation when processing invalid function names. Exploiting this vulnerability allows an attacker to execute arbitrary code remotely...

PT-2022-12947 · Phoenix · Phoenix.Html

Name of the Vulnerable Software and Affected Versions: Phoenix Phoenix.HTML aka phoenix html versions prior to 3.0.4 Description: The issue allows XSS in HEEx class attributes. The class attribute was not protected against XSS attacks when using HEEx. Recommendations: For versions prior to 3.0.4,...

GHSA-QPP2-2MCP-2WM5 Unauthenticated user can list hidden document from multiple velocity templates in XWiki

Impact A guest user without the right to view pages of the wiki can still list documents by rendering some velocity documents. Patches The problem has been patched in XWiki versions 12.10.11, 13.4.4, and 13.9-rc-1. Workarounds There is no known workaround for this problem. References...

CVE-2022-24820 Unauthenticated user can list hidden document from multiple velocity templates

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A guest user without the right to view pages of the wiki can still list documents by rendering some velocity documents. The problem has been patched in XWiki versions 12.10.11, 13.4.4, and...