CVE-2025-61318: Path Traversal: '../filedir'

Emlog Pro 2.5.20 has an arbitrary file deletion vulnerability. This vulnerability stems from the admin/template.php component and the admin/plugin.php component. They fail to perform path verification and dangerous code filtering for deletion parameters, allowing attackers to exploit this feature...

CVE-2025-29405: Unrestricted Upload of File with Dangerous Type

An arbitrary file upload vulnerability in the component /admin/template.php of emlog pro 2.5.0 and pro 2.5. allows attackers to execute arbitrary code via uploading a crafted PHP file...

CVE-2025-29405

An arbitrary file upload vulnerability in the component /admin/template.php of emlog pro 2.5.0 and pro 2.5. allows attackers to execute arbitrary code via uploading a crafted PHP file...

PT-2025-8944

Name of the Vulnerable Software and Affected Versions SUCMS version 1.0 Description The issue allows attackers to execute a directory traversal and arbitrary file deletion via a crafted GET request. This is due to a problem in the component admin template.php. Recommendations For SUCMS version 1....

PT-2023-29309

Name of the Vulnerable Software and Affected Versions SeaCMS version 12.8 Description An issue in the software allows an attacker to execute arbitrary code via the admin template.php component. Recommendations For SeaCMS version 12.8, at the moment, there is no information about a newer version...

Arbitrary file deletion

emlog 2.1.9 is vulnerable to Arbitrary file deletion via admin\template.php...

CVE-2023-37049

emlog 2.1.9 is vulnerable to Arbitrary file deletion via admin\template.php...

CVE-2023-37049

emlog 2.1.9 is vulnerable to Arbitrary file deletion via admin\template.php...

CVE-2023-37049: Missing Authorization

emlog 2.1.9 is vulnerable to Arbitrary file deletion via admin\template.php...

CVE-2023-0783

A vulnerability was found in EcShop 4.1.5. It has been classified as critical. This affects an unknown part of the file /ecshop/admin/template.php of the component PHP File Handler. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been...

CVE-2020-21654

emlog v6.0 contains a vulnerability in the component admin\template.php, which allows attackers to getshell via a crafted Zip file...

CVE-2020-21654

emlog v6.0 contains a vulnerability in the component admin\template.php, which allows attackers to getshell via a crafted Zip file...

CVE-2020-21654: Undefined Security Weakness

emlog v6.0 contains a vulnerability in the component admin\template.php, which allows attackers to getshell via a crafted Zip file...

CVE-2020-12639

phpList before 3.5.3 allows XSS, with resultant privilege elevation, via lists/admin/template.php...

CVE-2020-12639

phpList before 3.5.3 allows XSS, with resultant privilege elevation, via lists/admin/template.php...

CVE-2020-12639: Improper Neutralization of Input During Web Page Generation

phpList before 3.5.3 allows XSS, with resultant privilege elevation, via lists/admin/template.php...

CVE-2019-17073

emlog through 6.0.0beta allows remote authenticated users to delete arbitrary files via admin/template.php?action=del&tpl=../ directory traversal...

PT-2019-14939

Name of the Vulnerable Software and Affected Versions emlog versions prior to 6.0.0beta Description The issue allows remote authenticated users to delete arbitrary files. This is achieved through a directory traversal vulnerability in the "admin/template.php" endpoint, specifically when the...

CVE-2019-17073: Improper Limitation of a Pathname to a Restricted Directory

emlog through 6.0.0beta allows remote authenticated users to delete arbitrary files via admin/template.php?action=del&tpl=../ directory traversal...

PT-2018-13762

Name of the Vulnerable Software and Affected Versions SeaCMS version 6.64 Description The issue allows for arbitrary directory listing. This can be achieved through specific requests to the upload/admin/admin template.php endpoint, where the path parameter is manipulated to access directories...