velocity: arbitrary code execution when attacker is able to modify templates

A flaw was found in velocity. An attacker, able to modify Velocity templates, may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. The highest threat from this vulnerability is to data confidentiality and integrity...

velocity: arbitrary code execution when attacker is able to modify templates

A flaw was found in velocity. An attacker, able to modify Velocity templates, may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. The highest threat from this vulnerability is to data confidentiality and integrity...

velocity: arbitrary code execution when attacker is able to modify templates

A flaw was found in velocity. An attacker, able to modify Velocity templates, may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. The highest threat from this vulnerability is to data confidentiality and integrity...

OESA-2021-1157 velocity security update

Velocity is a Java-based template engine. It permits anyone to use the simple yet powerful template language to reference objects defined in Java code. Security Fixes: An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the...

Mono MonoX CMS Code Execution Vulnerability

MonoX CMS is an ASP.NET-based content management system CMS and social networking platform from Mono Croatia. A security vulnerability exists in Mono MonoX CMS 5.1.40.5152 and earlier versions. The vulnerability can be exploited by an attacker to execute arbitrary code by modifying an ASPX templa...

CVE-2020-12470

MonoX through 5.1.40.5152 allows administrators to execute arbitrary code by modifying an ASPX template...

Command Execution Vulnerability in EyouCms Backend

EyouCms is a free + open source enterprise content management system developed on the core of TP5.0 framework. EyouCms backend command execution vulnerability , attackers can use the vulnerability to modify the template at the existence of getshell vulnerability , you can execute any PHP code...

FineCMS一处SQL注入

简要描述： 某处过滤不严格导致sql注入 详细说明： 在用户修改个人头像的地方： http://localhost:8081/index.php?s=member&c=info&a=avatar 没有对提交的参数进行过滤： $data = $this-input-post'data', TRUE; 直接带入了sql查询： $this-member-updatearray'avatar'= $data'avatar', 'id=' . $this-memberinfo'id'; 于是造成注入，本人使用如下注入代码： 'or updatexml1,concat0x7e,version,0...

Destoon Backend Arbitrary Code Execution Vulnerability

Destoon website management system is based on PHP + MySQL open source website building software. Destoon backend exists arbitrary code execution vulnerability, Destoon backend has the ability to modify the template online, due to the content of the template is not allowed to write malicious php...

Drupal Privatemsg Module Security Bypass Security Issue

No description provided by source. A security issue has been reported in the Privatemsg module for Drupal, which can be exploited by malicious users to bypass certain security restrictions. The security issue exists due to improper access permission checks in the Email Notification...

CVE-2006-1895

Direct static code injection vulnerability in includes/template.php in phpBB allows remote authenticated users with write access to execute arbitrary PHP code by modifying a template in a way that 1 bypasses a loose "." regular expression to match BEGIN and END statements in overallheader.tpl, or...