270 matches found
CVE-2026-120249
Thelia Back-office Default Twig Template before 1.1.1 contains a cross-site request forgery vulnerability in the /admin/product/combinations/update and /admin/product/default-price/update routes, which accept GET requests without anti-CSRF token checks. Attackers can lure a logged-in administrato...
CVE-2026-120249
The Thelia Back-office Default Twig Template (versions prior to 1.1.1 ) is vulnerable to a cross-site request forgery (CSRF) vulnerability. The flaw exists in the /admin/product/combinations/update and /admin/product/default-price/update routes because they accept GET requests without performing ...
CVE-2026-120249 Thelia Back-office Default Twig Template before 1.1.1 CSRF via Product Combination Routes
Thelia Back-office Default Twig Template before 1.1.1 contains a cross-site request forgery vulnerability in the /admin/product/combinations/update and /admin/product/default-price/update routes, which accept GET requests without anti-CSRF token checks. Attackers can lure a logged-in administrato...
CVE-2026-120249 Thelia Back-office Default Twig Template before 1.1.1 CSRF via Product Combination Routes
Thelia Back-office Default Twig Template before 1.1.1 contains a cross-site request forgery vulnerability in the /admin/product/combinations/update and /admin/product/default-price/update routes, which accept GET requests without anti-CSRF token checks. Attackers can lure a logged-in administrato...
CVE-2026-120249 Thelia Back-office Default Twig Template before 1.1.1 CSRF via Product Combination Routes
Thelia Back-office Default Twig Template before 1.1.1 contains a cross-site request forgery vulnerability in the /admin/product/combinations/update and /admin/product/default-price/update routes, which accept GET requests without anti-CSRF token checks. Attackers can lure a logged-in administrato...
EUVD-2026-114746
Thelia Back-office Default Twig Template before 1.1.1 contains a cross-site request forgery vulnerability in the /admin/product/combinations/update and /admin/product/default-price/update routes, which accept GET requests without anti-CSRF token checks. Attackers can lure a logged-in administrato...
CVE-2026-120249
Thelia Back-office Default Twig Template before 1.1.1 contains a cross-site request forgery vulnerability in the /admin/product/combinations/update and /admin/product/default-price/update routes, which accept GET requests without anti-CSRF token checks. Attackers can lure a logged-in administrato...
CVE-2026-120249: Thelia Thelia Back-office Default Twig Template: Thelia Back-office Default Twig Template before 1.1.1 contains a cross-site request forgery vulnerability in the…
Thelia Back-office Default Twig Template before 1.1.1 contains a cross-site request forgery vulnerability in the /admin/product/combinations/update and /admin/product/default-price/update routes, which accept GET requests without anti-CSRF token checks. Attackers can lure a logged-in administrato...
PT-2026-134690
Thelia Back-office Default Twig Template before 1.1.1 contains a cross-site request forgery vulnerability in the /admin/product/combinations/update and /admin/product/default-price/update routes, which accept GET requests without anti-CSRF token checks. Attackers can lure a logged-in administrato...
CVE-2026-31857
CVE-2026-31857: Craft CMS control panel RCE CVE-2026-31857 is a remote code execution issue in Craft CMS relational condition rules. BaseElementSelectConditionRule::getElementIds renders user-controlled input as an unsandboxed Twig template. An authenticated Control Panel user can submit a crafte...
Exploit for CVE-2026-92592
CVE-2026-92592: Craft CMS authenticated RCE Proof of concept...
Exploit for Code Injection in Craftcms Craft_Cms
CVE-2026-31857: Craft CMS control panel RCE CVE-2026-31857 is...
DRUPAL-CONTRIB-2026-187
This module enables you to use AI to fill in or replace text in CKEditor. The module doesn't sufficiently mitigate Twig template injections in certain AI CKEditor rules, making it possible to use Twig functions to extract certain confidential system data...
Solspace Freeform: Limited Twig template injection via submitted field values
Summary A limited server-side Twig template injection issue was identified in Solspace Freeform for Craft CMS. In affected versions, submitted form field values could be evaluated as Twig in certain rendering contexts. Unauthenticated users could submit Twig expressions through public Freeform...
GHSA-GXRG-X694-283W Solspace Freeform: Limited Twig template injection via submitted field values
Summary A limited server-side Twig template injection issue was identified in Solspace Freeform for Craft CMS. In affected versions, submitted form field values could be evaluated as Twig in certain rendering contexts. Unauthenticated users could submit Twig expressions through public Freeform...
CVE-2026-73858 Solspace Freeform: Limited Twig template injection via submitted field values
Solspace Freeform plugin for Craft CMS 5.x is a super flexible form-building tool. From 5.0.0 through 5.10.13, submitted values from public Freeform forms can be evaluated by the isolated Twig renderer when rendered into HTML attributes. An unauthenticated attacker can place Twig expressions in...
CVE-2026-73858 Solspace Freeform: Limited Twig template injection via submitted field values
Solspace Freeform plugin for Craft CMS 5.x is a super flexible form-building tool. From 5.0.0 through 5.10.13, submitted values from public Freeform forms can be evaluated by the isolated Twig renderer when rendered into HTML attributes. An unauthenticated attacker can place Twig expressions in...
EUVD-2026-85334
Solspace Freeform plugin for Craft CMS 5.x is a super flexible form-building tool. From 5.0.0 through 5.10.13, submitted values from public Freeform forms can be evaluated by the isolated Twig renderer when rendered into HTML attributes. An unauthenticated attacker can place Twig expressions in...
CVE-2026-73858 Solspace Freeform: Limited Twig template injection via submitted field values
Solspace Freeform plugin for Craft CMS 5.x is a super flexible form-building tool. From 5.0.0 through 5.10.13, submitted values from public Freeform forms can be evaluated by the isolated Twig renderer when rendered into HTML attributes. An unauthenticated attacker can place Twig expressions in...
PT-2026-97681
Name of the Vulnerable Software and Affected Versions AI CKEditor versions 0.0.0 through 1.4.3 Description Improper neutralization of special elements used in a template engine allows for code injection. The module fails to sufficiently mitigate Twig template injections in certain rules, enabling...