PT-2026-48473

Name of the Vulnerable Software and Affected Versions go-base versions prior to 2026-05-18 Description The JWT signing secret is hardcoded to the string random in the dev.env template and as a programmatic fallback in the cmd/serve.go file. This allows an attacker to forge tokens for any user,...

CVE-2026-38930

OpenRapid RapidCMS v1.3.1 was discovered to contain an authentication bypass in the /template/default/menu.php component. This vulnerability is exploited via injecting a crafted SQL payload into the name cookie parameter...

PT-2026-44038

Name of the Vulnerable Software and Affected Versions OpenRapid RapidCMS version 1.3.1 Description An authentication bypass exists in the '/template/default/menu.php' endpoint. This issue occurs when a crafted SQL payload is injected into the name cookie parameter, allowing an attacker to...

CVE-2026-38930

OpenRapid RapidCMS v1.3.1 was discovered to contain an authentication bypass in the /template/default/menu.php component. This vulnerability is exploited via injecting a crafted SQL payload into the name cookie parameter...

OpenRapid RapidCMS 安全漏洞

OpenRapid RapidCMS is a fast, simple, and useful CMS system developed under the OpenRapid open-source framework. Version 1.3.1 of OpenRapid RapidCMS contains a security vulnerability. This vulnerability stems from a flaw in the /template/default/menu.php component, where authentication bypasses a...

CVE-2026-38930

OpenRapid RapidCMS v1.3.1 contains an authentication bypass vulnerability in the /template/default/menu.php component. The flaw is caused by the improper neutralization of special elements used in an SQL command, which allows an attacker to bypass authentication by injecting a crafted SQL payload...

CVE-2026-38930: Improper Neutralization of Special Elements used in an SQL Command

OpenRapid RapidCMS v1.3.1 was discovered to contain an authentication bypass in the /template/default/menu.php component. This vulnerability is exploited via injecting a crafted SQL payload into the name cookie parameter...

CVE-2024-1200

A vulnerability was found in Jspxcms 10.2.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /template/1/default/. The manipulation leads to information disclosure. The attack may be launched remotely. The exploit has been disclosed to the public and...

PT-2024-17394 · Jspxcms · Jspxcms

Name of the Vulnerable Software and Affected Versions: Jspxcms version 10.2.0 Description: A vulnerability was found in Jspxcms and classified as problematic. It affects some unknown functionality of the file /template/1/default/. The manipulation leads to information disclosure. The attack may b...

CVE-2023-4446: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability, which was classified as critical, was found in OpenRapid RapidCMS 1.3.1. This affects an unknown part of the file template/default/category.php. The manipulation of the argument id leads to sql injection. The exploit has been disclosed to the public and may be used. The associate...

CVE-2018-20327

Chamilo LMS version 1.11.8 contains XSS in main/template/default/admin/gradebooklist.tpl in the gradebook dependencies tool, allowing authenticated users to affect other users, under specific conditions of permissions granted by administrators. This is considered "low risk" due to the nature of t...

CVE-2018-20327: Improper Neutralization of Input During Web Page Generation

Chamilo LMS version 1.11.8 contains XSS in main/template/default/admin/gradebooklist.tpl in the gradebook dependencies tool, allowing authenticated users to affect other users, under specific conditions of permissions granted by administrators. This is considered "low risk" due to the nature of t...

PT-2018-15310

Name of the Vulnerable Software and Affected Versions Chamilo LMS version 1.11.8 Description The issue affects the gradebook dependencies tool in the main/template/default/admin/gradebook list.tpl file, allowing authenticated users to impact other users under specific permission conditions grante...

Code injection

Discuz! X3.4 allows XSS via admin.php because admincp/admincpsetting.php and template\default\common\footer.htm mishandles statcode field from third-party stats code...

CVE-2018-19464: Improper Neutralization of Input During Web Page Generation

Discuz! X3.4 allows XSS via admin.php because admincp/admincpsetting.php and template\default\common\footer.htm mishandles statcode field from third-party stats code...

PT-2018-14855

Name of the Vulnerable Software and Affected Versions XiaoCms version 20141229 Description An issue was discovered related to XSS in the template/default/show product.html file. Recommendations For XiaoCms version 20141229, consider restricting access to the template/default/show product.html fil...

CVE-2018-19195: Improper Neutralization of Input During Web Page Generation

An issue was discovered in XiaoCms 20141229. There is XSS related to the template\default\showproduct.html file...

CVE-2006-4421: Undefined Security Weakness

Cross-site scripting XSS vulnerability in template/default/thankscomment.php in Yet Another PHP Image Gallery YaPIG 0.95b allows remote attackers to inject arbitrary web script or HTML via the DREFRESHURL parameter...