CVE-2026-39345 OrangeHRM Affected by Arbitrary File Read via Path Traversal in Email Template Loader

OrangeHRM is a comprehensive human resource management HRM system. From 5.0 to 5.8, OrangeHRM Open Source fails to restrict email template file resolution to the intended plugins directory, allowing an authenticated actor who can influence the template path to read arbitrary local files. This...

CVE-2026-39345

OrangeHRM Open Source versions 5.0–5.8 are affected by a path traversal vulnerability in the Email Template Loader that can allow an authenticated actor who can influence the template path to read arbitrary local files. Root cause: insufficient restriction of template file resolution to the inten...

CVE-2026-39345 OrangeHRM Affected by Arbitrary File Read via Path Traversal in Email Template Loader

OrangeHRM is a comprehensive human resource management HRM system. From 5.0 to 5.8, OrangeHRM Open Source fails to restrict email template file resolution to the intended plugins directory, allowing an authenticated actor who can influence the template path to read arbitrary local files. This...

GHSA-X6M9-38VM-2XHF Scriban has an authorization bypass due to stale include cache surviving TemplateContext.Reset()

Summary TemplateContext.Reset claims that a TemplateContext can be reused safely on the same thread, but it does not clear CachedTemplates. If an application pools TemplateContext objects and uses an ITemplateLoader that resolves content per request, tenant, or user, a previously authorized inclu...

Scriban has an authorization bypass due to stale include cache surviving TemplateContext.Reset()

Summary TemplateContext.Reset claims that a TemplateContext can be reused safely on the same thread, but it does not clear CachedTemplates. If an application pools TemplateContext objects and uses an ITemplateLoader that resolves content per request, tenant, or user, a previously authorized inclu...

EUVD-2022-6700

Malicious code in bioql PyPI...

htl-template-loader (>=1.2.0, <=3.0.0), ideal-cli (>=1.0.0-alpha.1, <=1.0.0-alpha.3) +1 more potentially affected by unknown CVE via standard-version (8.0.0)

standard-version NPM version 8.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on standard-version and may be impacted: - htl-template-loader =1.2.0, =1.0.0-alpha.1, =1.0.0-alpha.3 - next-standard-version 2.1.3 Source cves: unknown CVE Source advisory...

CVE-2008-7254

Directory traversal vulnerability in includes/template-loader.php in Irmin CMS formerly Pepsi CMS 0.5 and 0.6 BETA2, when registerglobals is enabled, allows remote attackers to include and execute arbitrary files via a .. dot dot in the RootPath parameter. NOTE: some of these details are obtained...

Pepsi CMS (Irmin cms) pepsi-0.6-BETA2 - Multiple Local File

Pepsi CMS Irmin cms pepsi-0.6-BETA2 - Multiple Local File Pepsi CMS Irmin cms pepsi-0.6-BETA2 Multiple Local File Vulnerability fucking the Web Apps LFI 1 - attack edition /\ \ /\ \ /\ /\ \ \ \ \L\ \ \ /'\ /\ \ \ ,\ \ \ \ \ /\ /\ \ /'\ \ , /\ \ /' \ /' \ \ \ /\ \ \ /'\ \ \ /\ \ \ /\ /...