CVE-2026-40187

In egroupware version 26.0 and earlier, an authenticated administrator can achieve OS-level Remote Code Execution RCE by uploading a malicious eTemplate XML file .xet to the VFS /etemplates mount. The Widget::expandname method passes template widget attribute values directly into a PHP eval call...

CVE-2026-40187

Summary (concrete details from sources): CVE-2026-40187 affects EGroupware 26.0 and earlier. An authenticated administrator can trigger OS-level RCE by uploading a malicious eTemplate XML file (.xet) to the VFS /etemplates mount. The vuln stems from Widget::expand_name() passing template widget a...

GHSA-8737-2X9G-XJJ7 EGroupware has Authenticated RCE via Malicious eTemplate Upload

Summary An authenticated administrator can achieve OS-level Remote Code Execution RCE by uploading a malicious eTemplate XML file .xet to the VFS /etemplates mount. The Widget::expandname method passes template widget attribute values directly into a PHP eval call with only double-quote escaping...

EGroupware has Authenticated RCE via Malicious eTemplate Upload

Summary An authenticated administrator can achieve OS-level Remote Code Execution RCE by uploading a malicious eTemplate XML file .xet to the VFS /etemplates mount. The Widget::expandname method passes template widget attribute values directly into a PHP eval call with only double-quote escaping...

PT-2026-56213

Name of the Vulnerable Software and Affected Versions egroupware versions 26.0 and earlier Description An authenticated administrator can achieve OS-level Remote Code Execution RCE by uploading a malicious eTemplate XML file .xet to the VFS /etemplates mount. The issue exists in the Widget::expan...

EUVD-2024-52872

Malicious code in bioql PyPI...

CVE-2024-55972

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in chriscarvache eTemplates etemplates allows SQL Injection.This issue affects eTemplates: from n/a through = 0.2.1...

WordPress eTemplates 0.2.1 SQL Injection Vulnerability

CVE-2024-55972 eTemplates = 0.2.1 - Unauthenticated SQL Injection Description The eTemplates plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 0.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing S...

CVE-2024-55972

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in chriscarvache eTemplates etemplates allows SQL Injection.This issue affects eTemplates: from n/a through = 0.2.1...

CVE-2024-55972 WordPress eTemplates plugin <= 0.2.1 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Chris Carvache eTemplates allows SQL Injection.This issue affects eTemplates: from n/a through 0.2.1...

CVE-2024-55972

CVE-2024-55972 is an SQL injection vulnerability in eTemplates (WordPress plugin). The issue arises from improper neutralization of input elements used in SQL commands, allowing unauthenticated injection into the database. Affected versions are reported as eTemplates from n/a up to 0.2.1. Current...

CVE-2024-55972 WordPress eTemplates plugin <= 0.2.1 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in chriscarvache eTemplates etemplates allows SQL Injection.This issue affects eTemplates: from n/a through = 0.2.1...

PT-2024-36624 · Unknown · Etemplates

Name of the Vulnerable Software and Affected Versions: eTemplates versions 0.2.1 and earlier Description: The issue is related to the improper neutralization of special elements used in an SQL command, allowing SQL injection. This problem can be exploited to inject SQL code, potentially leading t...

WordPress plugin eTemplates SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection...

WordPress eTemplates plugin <= 0.2.1 - SQL Injection vulnerability

SQL Injection vulnerability discovered by João Pedro Soares de Alcântara - Kinorth Patchstack Alliance in WordPress Plugin eTemplates versions = 0.2.1...

UNA 10.0.0 RC1 - (polyglot.php) Persistent Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: UNA - 10.0.0-RC1 stored XSS vuln. Exploit Author: Greg.Priest Vendor Homepage: https://una.io/ Software Link: https://github.com/unaio/una/tree/master/studio Version: UNA - 10.0.0-RC1 Tested on: Windows/Linux CVE : CVE-2019-1480...

UNA 10.0.0 RC1 Cross Site Scripting

Exploit Title: UNA - 10.0.0-RC1 stored XSS vuln. Date: 2019 08 10 Exploit Author: Greg.Priest Vendor Homepage: https://una.io/ Software Link: https://github.com/unaio/una/tree/master/studio Version: UNA - 10.0.0-RC1 Tested on: Windows/Linux CVE : CVE-2019-14804 UNA-v.10.0.0-RC1 Stored XSS...

UNA 10.0.0 RC1 - 'polyglot.php' Persistent Cross-Site Scripting

Exploit Title: UNA - 10.0.0-RC1 stored XSS vuln. Date: 2019 08 10 Exploit Author: Greg.Priest Vendor Homepage: https://una.io/ Software Link: https://github.com/unaio/una/tree/master/studio Version: UNA - 10.0.0-RC1 Tested on: Windows/Linux CVE : CVE-2019-14804 UNA-v.10.0.0-RC1 Stored XSS...

CVE-2019-14804

studio/polyglot.php?page=etemplates in UNA 10.0.0-RC1 allows XSS via the System Name field under Emails during template editing...

CVE-2019-14804

The CVE-2019-14804 issue affects UNA 10.0.0-RC1, where a stored Cross-Site Scripting (XSS) vulnerability exists in studio/polyglot.php?page=etemplates via the Emails templates when editing the System Name field. The root cause, as described by CNVD, is a lack of proper validation of client-side d...