CVE-2025-1661

CVE-2025-1661 - 인증되지 않은 로컬 파일 포함 LFI - HUSKY – WooCommerce용 제품 필터 프로페셔널 설명 HUSKY – WooCommerce용 제품 필터 프로페셔널 WordPress 플러그인은 버전 1.3.6.5 이하에서 wooftextsearch AJAX 액션의 template 파라미터를 통해 로컬 파일 포함LFI 취약점에 취약합니다. 이로 인해 인증되지 않은 공격자 가 서버에서 임의의 파일을 포함하고 실행할 수 있으며, 잠재적으로 다음을 초래할 수 있습니다: 접근 제어 우회 민감한 데이터 추출 ...

CVE-2025-1661

CVE-2025-1661 - HUSKY – Products Filter Professional for WooCommerce 中的未认证本地文件包含（LFI） 描述 WordPress 的 HUSKY – Products Filter Professional for WooCommerce 插件在所有版本中（最高至 1.3.6.5 ，含该版本）存在 本地文件包含（LFI） 漏洞，该漏洞可通过 wooftextsearch AJAX 动作的 template 参数触发。 该漏洞允许未认证的攻击者 在服务器上包含并执行任意文件，可能导致以下后果： 绕过访问控制 提取敏感数据...

phpcms-2008-CVE-2018-19127

phpcms-2008-CVE-2018-19127 最近、phpcms 2008 のソースコードの /type.php に脆弱性を発見しました。攻撃者が「/type.php?template=tag;@unlinkFILE;assert$POST1;//../rss」のような細工されたリクエストを送信すると、悪意のあるコンテンツ（この場合は「@unlinkFILE;assert$POST1;」）がキャッシュファイル（この場合は「/cachetemplate/rss.tpl.php」）に書き込まれます。 /type.php には以下のコードがあります： root@kitploit:...

CVE-2025-4524

CVE-2025-4524 - 未认证的 madara-core WordPress 主题 LFI WordFence 链接 描述 漏洞存在于 madara 的 madaraloadmore 操作中，template 参数来自用户的任意数据，并被传递给 PHP 的 include 函数。 漏洞 漏洞存在于 madara 的 madaraloadmore 操作中，template 参数来自用户的任意数据，并被传递给 PHP 的 include 函数。 相关漏洞代码如下： root@kitploit: addaction 'wpajaxmadaraloadmore', array $this...

CVE-2024-7120-Exploit-by-Dark-07x

Raisecom デバイス コマンドインジェクション CVE-2024-7120 概念実証! 概要 RAISECOM ゲートウェイデバイスにおいて、コマンドインジェクションの脆弱性が確認されました。影響を受けるモデルは、MSG1200、MSG2100E、MSG2200、MSG2300 です。この脆弱性により、リモートの攻撃者が Web インターフェースを介してシステム上で任意のコマンドを実行できる可能性があります。問題は listbaseconfig.php スクリプトに存在し、特に template パラメータを介して発生します。インターネット上の 25,112...

CVE-2024-7120

Raisecom 기기 명령 주입 CVE-2024-7120 개념 증명! 개요 RAISECOM 게이트웨이 기기모델 MSG1200, MSG2100E, MSG2200, MSG2300에서 명령 주입 취약점이 확인되었습니다. 이 취약점으로 인해 원격 공격자가 웹 인터페이스를 통해 시스템에서 임의 명령을 실행할 수 있습니다. 문제는 listbaseconfig.php 스크립트, 특히 template 매개변수에 있으며, 인터넷 상의 25,112개 이상의 기기에 영향을 미칩니다. ✔ FOFA : title="web user login" &&...

gitpython: GitPython: Remote Code Execution via malicious Git hooks

A flaw was found in GitPython. This vulnerability allows a remote attacker to achieve arbitrary code execution. By supplying a specially crafted template parameter to the Repo.init function, an attacker can point to a directory containing malicious Git hooks. When Git operations are performed on...

CVE-2019-3396

CVE-2019-3396 Confluence Widget Connector 경로 탐색 CVE-2019-3396 RCE POC root@kitploit: POST /rest/tinymce/1/macro/preview HTTP/1.1 Host: x.x.x.x Connection: close Accept-Encoding: gzip, deflate Accept: / User-Agent: Mozilla/5.0 X11; Linux x8664; rv:60.0 Gecko/20100101 Firefox/60.0 Content-Type:...

WordPress Tutor LMS plugin <= 4.0.5 - Unauthenticated Remote Code Execution via 'template' and 'data' POST Parameters vulnerability

Unauthenticated Remote Code Execution via 'template' and 'data' POST Parameters vulnerability discovered by Slopothecary in WordPress Plugin Tutor LMS versions = 4.0.5...

CVE-2026-76218

A flaw was found in GitPython. This vulnerability allows a remote attacker to achieve arbitrary code execution. By supplying a specially crafted template parameter to the Repo.init function, an attacker can point to a directory containing malicious Git hooks. When Git operations are performed on...

SUSE CVE-2026-76218

GitPython before 3.1.58 contains a remote code execution vulnerability in Repo.init that forwards unsafe git options without validation. Attackers can supply a template parameter pointing to a directory with malicious git hooks that execute arbitrary code when git operations are performed on the...

CVE-2026-76218

GitPython before 3.1.58 has an RCE flaw in Repo.init that passes unvalidated git options, allowing attackers to inject a template directory with malicious hooks executed during subsequent git operations. Affected libraries should upgrade to 3.1.58 or later; no in-the-wild exploitation is reported...

CVE-2026-76218 GitPython before 3.1.58 Remote Code Execution via Repo.init

GitPython before 3.1.58 contains a remote code execution vulnerability in Repo.init that forwards unsafe git options without validation. Attackers can supply a template parameter pointing to a directory with malicious git hooks that execute arbitrary code when git operations are performed on the...

VulnCheck KEV: CVE-2026-49049

The Helix3 plugin for Joomla exposes an ajax handler task, that allows unauthenticated attackers to delete arbitrary files, write arbitrary JSON files and update template parameters...

Arbitrary Code Injection

Overview GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to Arbitrary Code Injection via the Repo.init process. An attacker can execute arbitrary code by supplying a malicious template parameter that points to a directory...

CVE-2026-15404

The Lpagery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in versions up to, and including, 2.5.7. This is due to insufficient input sanitization and output escaping in the lpageryaddfiltertexttemplatepost function, which is hooked to adminfooter and echoes the...

CVE-2026-15404

CVE-2026-15404 concerns the Lpagery WordPress plugin (&lt;= 2.5.7). It enables a Stored Cross-Site Scripting (XSS) via post titles due to insufficient sanitization and output escaping in lpagery_add_filter_text_template_post(), which runs on admin_footer and echoes the raw post_title of the post ...

CVE-2026-46687

Emlog is an open source website building system. In 2.6.13 and earlier, the article publishing interface stores a path-traversal template parameter from apicontroller.php without validation, and logcontroller.php later checks fileexists and calls include View::getView$template, allowing an...

EUVD-2026-44986

Emlog is an open source website building system. In 2.6.13 and earlier, the article publishing interface stores a path-traversal template parameter from apicontroller.php without validation, and logcontroller.php later checks fileexists and calls include View::getView$template, allowing an...

CVE-2026-46687

CVE-2026-46687 affects Emlog prior to or including 2.6.13. The flaw stems from an unvalidated path-traversal template parameter used by api_controller.php and a subsequent include in View::getView($template) after a file_exists check in log_controller.php. This enables an authenticated author to ...