146 matches found
CVE-2025-65961
Contao CMS vulnerability CVE-2025-65961 enables cross-site scripting via template output in affected templates. Affected versions: 4.0.0–4.13.57, 5.0–before 5.3.42, and before 5.6.5. Root cause: injection of code into template output executed in both front-end and back-end browsers. Mitigation/Re...
CVE-2025-65961 Contao is vulnerable to cross-site scripting in templates
Contao is an Open Source CMS. From version 4.0.0 to before 4.13.57, before 5.3.42, and before 5.6.5, it is possible to inject code into the template output that will be executed in the browser in the front end and back end. This issue has been patched in versions 4.13.57, 5.3.42, and 5.6.5. A...
CVE-2025-65961 Contao is vulnerable to cross-site scripting in templates
Contao is an Open Source CMS. From version 4.0.0 to before 4.13.57, before 5.3.42, and before 5.6.5, it is possible to inject code into the template output that will be executed in the browser in the front end and back end. This issue has been patched in versions 4.13.57, 5.3.42, and 5.6.5. A...
CVE-2025-63889
The fetch function in file thinkphp\library\think\Template.php in ThinkPHP 5.0.24 allows attackers to read arbitrary files via crafted file path in a template value...
CVE-2025-62267
Multiple cross-site scripting XSS vulnerabilities in web content template’s select structure page in Liferay Portal 7.4.3.35 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 update 35 through update 92 allow remote attackers to inject arbitrary we...
EUVD-2005-3167
Malware in sbrugna...
EUVD-2015-0022
Malware in sbrugna...
EUVD-2009-1934
Malware in sbrugna...
EUVD-2020-2916
Malware in sbrugna...
EUVD-2021-16748
Malware in sbrugna...
EUVD-2018-21441
Malware in sbrugna...
EUVD-2023-28556
Malicious code in bioql PyPI...
EUVD-2023-23552
Malicious code in bioql PyPI...
EUVD-2023-2677
Malicious code in bioql PyPI...
EulerOS Virtualization 2.13.1 : python-jinja2 (EulerOS-SA-2025-2182)
According to the versions of the python-jinja2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Jinja is an extensible templating engine. Prior to 3.1.6, an oversight in how the Jinja sandboxed environment interacts with...
CVE-2025-58800
Cross-Site Request Forgery CSRF vulnerability in Steve Truman WP Email Template wp-email-template allows Cross Site Request Forgery.This issue affects WP Email Template: from n/a through = 2.8.6...
XWiki Platform 安全漏洞
XWiki Platform is XWiki's open source suite of Wiki platforms for creating web collaboration applications. A security vulnerability exists in XWiki Platform, which stems from a template containing reflective cross-site scripting that could lead to the execution of malicious code. The following...
Security Bulletin: Jinja Template Sandbox Escape via Indirect str.format Execution Prior to 3.1.5
Summary Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control...
The vulnerability of the Jinja HTML templating compiler lies in its failure to properly eliminate special elements during template creation. This allows attackers to trigger a service failure.
The vulnerability of the Jinja HTML template compiler relates to the lack of measures taken to neutralize special elements in the template creation mechanism. Exploiting this vulnerability can allow an attacker to cause service failures...