75 matches found
CustomC2ChannelTemplate
IAT Hooking for custom C2 channels This is a simple PoC and template for developing custom C2 channels for Cobalt Strike using IAT hooks applied by a reflective loader. Blog post: https://codex-7.gitbook.io/codexs-terminal-window/red-team/cobalt-strike/building-custom-c2-channels-by-hooking-winin...
CVE-2026-110592 BottleCRM 0.30 through 1.14.5 HTML Injection via Custom Invoice PDF Template
BottleCRM 0.30 through 1.14.5 contains an HTML injection vulnerability in renderinvoicetemplate that allows authenticated organization members to inject markup into custom-template invoice PDFs. Attackers can place HTML and CSS in notes, terms, client name or address fields to overlay totals, pay...
PT-2026-114034
šØ CVE-2026-110592 BottleCRM 0.30 through 1.14.5 contains an HTML injection vulnerability in render invoice template that allows authenticated organization members to inject markup into custom-template invoice PDFs. Attackers can place HTML and CSS in notes, terms, client name or address fields to...
CVE-2026-100280
In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template was possible...
CVE-2026-100280
In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template was possible...
CVE-2026-100280
In JetBrains YouTrack versions prior to 2026.2.19197 , a vulnerability exists that allows the creation of a project from an unreadable custom template . This issue is associated with a Missing Authorization flaw (CWE-862). No specific exploit details or remediation instructions are provided in th...
EUVD-2026-90024
In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template was possible...
PT-2026-103327
šØ CVE-2026-100280 In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template was possible š@cveNotify...
CVE-2026-100280: Missing Authorization
In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template was possible...
CVE-2026-49466 Draft List - Contributor Stored Cross-Site Scripting via Draft Title in Custom Drafts Template Attributes
Draft List is a WordPress plugin to manage and promote unpublished content. Versions 2.6.3 and below are vulnerable to stored Cross-Site Scripting XSS in the drafts shortcode and Draft List widget when the documented custom template option places the draft placeholder inside an HTML attribute. Th...
SUSE CVE-2026-44884
Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to before 2.33.8 and 2.39.1, a missing authorization vulnerability in the Custom Template file endpoint GET...
GO-2026-5333 Portainer missing authorization on custom template file endpoint, which exposes template content in github.com/portainer/portainer
Portainer missing authorization on custom template file endpoint, which exposes template content in github.com/portainer/portainer. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
CVE-2026-9724 MotorDesk <= 1.1.2 - Cross-Site Request Forgery to Settings Update
The MotorDesk plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.2. This is due to missing or incorrect nonce validation on the motordeskadminhome function. This makes it possible for unauthenticated attackers to update the plugin's...
PT-2026-51704
Name of the Vulnerable Software and Affected Versions MotorDesk versions prior to 1.1.3 Description The MotorDesk plugin for WordPress contains a Cross-Site Request Forgery CSRF flaw, which occurs when a web application allows an attacker to induce a user to perform actions they do not intend to...
CVE-2026-46476
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, CustomTemplate create and update mass-assignment allows cross-workspace template takeover. This issue has been patched in version 3.1.2...
EUVD-2026-35113
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, CustomTemplate create and update mass-assignment allows cross-workspace template takeover. This issue has been patched in version 3.1.2...
CVE-2026-46476 Flowise: CustomTemplate create+update mass-assignment allows cross-workspace template takeover
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, CustomTemplate create and update mass-assignment allows cross-workspace template takeover. This issue has been patched in version 3.1.2...
CVE-2026-46476
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, CustomTemplate create and update mass-assignment allows cross-workspace template takeover. This issue has been patched in version 3.1.2...
CVE-2026-44884
Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to before 2.33.8 and 2.39.1, a missing authorization vulnerability in the Custom Template file endpoint GET...
CVE-2026-41065: Improper Neutralization of Special Elements Used in a Template Engine
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Versions prior to 2.17.1 are vulnerable to remote code execution via the newsletter custom template directory feature. On a fresh install before the setup wizard is completed, all management endpoints are completely...