CVE-2025-4524

CVE-2025-4524 - ثغرة LFI بدون مصادقة في قالب ووردبريس madara-core رابط WordFence الوصف تقع الثغرة في إجراء madaraloadmore الخاص بقالب madara، حيث تكون معلمة template بيانات عشوائية من المستخدم ويتم تمريرها إلى دالة include في PHP. الثغرة تقع الثغرة في إجراء madaraloadmore الخاص بقالب madara، حيث...

phpcms-2008-CVE-2018-19127

phpcms-2008-CVE-2018-19127 Recently we found a vulnerability in /type.php of phpcms 2008 source code. When attackers send crafted requests like "/type.php?template=tag;@unlinkFILE;assert$POST1;//../rss", evil content in this case "@unlinkFILE;assert$POST1;" will be written into cache file in this...

CVE-2024-7120

إثبات المفهوم لثغرة حقن الأوامر في أجهزة Raisecom CVE-2024-7120 نظرة عامة تم تحديد ثغرة حقن أوامر في أجهزة بوابة RAISECOM، حيث تؤثر على الطرازات MSG1200 وMSG2100E وMSG2200 وMSG2300. تسمح هذه الثغرة للمهاجمين عن بُعد بتنفيذ أوامر عشوائية على النظام عبر واجهة الويب. تكمن المشكلة في السكريبت...

CVE-2024-7120-Exploit-by-Dark-07x

Raisecom Devices Command Injection CVE-2024-7120 إثبات المفهوم! نظرة عامة تم تحديد ثغرة حقن الأوامر في أجهزة بوابة RAISECOM، حيث تؤثر على الموديلات MSG1200 وMSG2100E وMSG2200 وMSG2300. تسمح هذه الثغرة للمهاجمين عن بعد بتنفيذ أوامر عشوائية على النظام عبر الواجهة الويب. المشكلة تكمن في السكريبت...

CVE-2025-1661

CVE-2025-1661 - Inclusion locale de fichier non authentifiée LFI dans HUSKY – Products Filter Professional pour WooCommerce Description Le plugin HUSKY – Products Filter Professional pour WooCommerce pour WordPress est vulnérable à l'inclusion locale de fichier LFI dans toutes les versions jusqu'...

CVE-2025-1661

CVE-2025-1661 - Inclusion Locale de Fichier LFI non authentifiée dans HUSKY – Products Filter Professional for WooCommerce Description Le plugin HUSKY – Products Filter Professional for WooCommerce pour WordPress est vulnérable à l'Inclusion Locale de Fichier LFI dans toutes les versions jusqu'à ...

CVE-2019-3396

CVE-2019-3396 اجتياز مسار موصل Widget في كونفلونس CVE-2019-3396 RCE POC POST /rest/tinymce/1/macro/preview HTTP/1.1 Host: x.x.x.x Connection: close Accept-Encoding: gzip, deflate Accept: / User-Agent: Mozilla/5.0 X11; Linux x8664; rv:60.0 Gecko/20100101 Firefox/60.0 Content-Type: application/json...

gitpython: GitPython: Remote Code Execution via malicious Git hooks

A flaw was found in GitPython. This vulnerability allows a remote attacker to achieve arbitrary code execution. By supplying a specially crafted template parameter to the Repo.init function, an attacker can point to a directory containing malicious Git hooks. When Git operations are performed on...

WordPress Tutor LMS plugin <= 4.0.5 - Unauthenticated Remote Code Execution via 'template' and 'data' POST Parameters vulnerability

Unauthenticated Remote Code Execution via 'template' and 'data' POST Parameters vulnerability discovered by Slopothecary in WordPress Plugin Tutor LMS versions = 4.0.5...

CVE-2026-76218

A flaw was found in GitPython. This vulnerability allows a remote attacker to achieve arbitrary code execution. By supplying a specially crafted template parameter to the Repo.init function, an attacker can point to a directory containing malicious Git hooks. When Git operations are performed on...

SUSE CVE-2026-76218

GitPython before 3.1.58 contains a remote code execution vulnerability in Repo.init that forwards unsafe git options without validation. Attackers can supply a template parameter pointing to a directory with malicious git hooks that execute arbitrary code when git operations are performed on the...

Duplicate Advisory: GitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via --template clone hooks

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-9rj7-rf2p-w77r. This link is maintained to preserve external references. Original Description GitPython before 3.1.58 contains a remote code execution vulnerability in Repo.init that forwards unsafe git options...

CVE-2026-76218

GitPython before 3.1.58 contains a remote code execution vulnerability in Repo.init that forwards unsafe git options without validation. Attackers can supply a template parameter pointing to a directory with malicious git hooks that execute arbitrary code when git operations are performed on the...

CVE-2026-76218

GitPython before 3.1.58 has an RCE flaw in Repo.init that passes unvalidated git options, allowing attackers to inject a template directory with malicious hooks executed during subsequent git operations. Affected libraries should upgrade to 3.1.58 or later; no in-the-wild exploitation is reported...

CVE-2026-76218 GitPython before 3.1.58 Remote Code Execution via Repo.init

GitPython before 3.1.58 contains a remote code execution vulnerability in Repo.init that forwards unsafe git options without validation. Attackers can supply a template parameter pointing to a directory with malicious git hooks that execute arbitrary code when git operations are performed on the...

CVE-2026-76218: Improper Neutralization of Argument Delimiters in a Command

GitPython before 3.1.58 contains a remote code execution vulnerability in Repo.init that forwards unsafe git options without validation. Attackers can supply a template parameter pointing to a directory with malicious git hooks that execute arbitrary code when git operations are performed on the...

VulnCheck KEV: CVE-2026-49049

The Helix3 plugin for Joomla exposes an ajax handler task, that allows unauthenticated attackers to delete arbitrary files, write arbitrary JSON files and update template parameters...

Arbitrary Code Injection

Overview GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to Arbitrary Code Injection via the Repo.init process. An attacker can execute arbitrary code by supplying a malicious template parameter that points to a directory...

CVE-2026-15404

The Lpagery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in versions up to, and including, 2.5.7. This is due to insufficient input sanitization and output escaping in the lpageryaddfiltertexttemplatepost function, which is hooked to adminfooter and echoes the...

CVE-2026-15404

CVE-2026-15404 concerns the Lpagery WordPress plugin (&lt;= 2.5.7). It enables a Stored Cross-Site Scripting (XSS) via post titles due to insufficient sanitization and output escaping in lpagery_add_filter_text_template_post(), which runs on admin_footer and echoes the raw post_title of the post ...