19658 matches found
CVE-2025-13523: Improper Neutralization of Input During Web Page Generation
Mattermost Confluence plugin version 1.7.0 fails to properly escape user-controlled display names in HTML template rendering which allows authenticated Confluence users with malicious display names to execute arbitrary JavaScript in victim browsers via sending a specially crafted OAuth2 connectio...
Calibre security vulnerabilities
Calibre is an open-source, free tool developed by Kovid Goyal, a personal developer from India. It serves as a comprehensive e-book reading management and format conversion tool. Versions of Calibre prior to 9.2.0 contained security vulnerabilities, which were caused by server-side template...
PT-2026-6769
Name of the Vulnerable Software and Affected Versions OpenSTAManager versions 2.9.8 and earlier Description OpenSTAManager is susceptible to an authenticated SQL injection issue within the Scadenzario Payment Schedule print template. Any authenticated user can exploit this to extract sensitive da...
PT-2026-6978
Name of the Vulnerable Software and Affected Versions GitLab AI Gateway versions 18.1.6 through 18.8.0 Description The GitLab AI Gateway’s Duo Workflow Service component contains a flaw related to improper code generation. This issue allows authenticated attackers to cause a Denial of Service or...
📄 XWiki 16.4.0 Remote Code Execution
Proof of concept exploit for a critical template injection vulnerability in XWiki Platform that allows unauthenticated remote code execution. The vulnerability affects XWiki versions 5.3-milestone-2 to 15.10.10 and 16.0.0-rc-1 to 16.4.0, potentially impacting thousands of enterprise wiki...
CVE-2026-25731: Improper Neutralization of Special Elements Used in a Template Engine
calibre is an e-book manager. Prior to 9.2.0, a Server-Side Template Injection SSTI vulnerability in Calibre's Templite templating engine allows arbitrary code execution when a user converts an ebook using a malicious custom template file via the --template-html or --template-html-index...
CVE-2025-70073
An issue in ChestnutCMS v.1.5.8 and before allows a remote attacker to execute arbitrary code via the template creation function...
BIT-DJANGO-2026-1285 Potential denial-of-service vulnerability in django.utils.text.Truncator HTML methods
An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. django.utils.text.Truncator.chars and Truncator.words methods with html=True and the truncatecharshtml and truncatewordshtml template filters allow a remote attacker to cause a potential denial-of-service via...
CVE-2024-12734
creationtimestamp| type| source ---|---|--- 2026-02-05 04:57:35+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2024/CVE-2024-12734.yaml 2026-02-07 21:02:56+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3meccxheos72i...
CVE-2026-1813
A vulnerability was found in bolo-blog bolo-solo up to 2.6.4. Affected is an unknown function of the file src/main/java/org/b3log/solo/bolo/pic/PicUploadProcessor.java of the component FreeMarker Template Handler. The manipulation of the argument File results in unrestricted upload. It is possibl...
EUVD-2025-206857
An issue in ChestnutCMS v.1.5.8 and before allows a remote attacker to execute arbitrary code via the template creation function...
PT-2026-6602
Name of the Vulnerable Software and Affected Versions ChestnutCMS versions prior to 1.5.9 Description An issue allows a remote attacker to execute arbitrary code via the template creation function. Recommendations Update to version 1.5.9 or later...
ChestnutCMS security vulnerabilities
ChestnutCMS is an enterprise-level content management system developed by Liweiyi, featuring a separation between the front-end and back-end components. Versions of ChestnutCMS prior to v1.5.8 contained security vulnerabilities; these vulnerabilities stemmed from the template creation feature,...
CVE-2025-70073: Improper Control of Generation of Code
An issue in ChestnutCMS v.1.5.8 and before allows a remote attacker to execute arbitrary code via the template creation function...
CVE-2025-70073
An issue in ChestnutCMS v.1.5.8 and before allows a remote attacker to execute arbitrary code via the template creation function...
CVE-2025-70073
An issue in ChestnutCMS v.1.5.8 and before allows a remote attacker to execute arbitrary code via the template creation function...
CVE-2025-70073
An issue in ChestnutCMS versions v.1.5.8 and before allows a remote attacker to execute arbitrary code via the template creation function . This vulnerability exists in the enterprise-level content management system developed by Liweiyi. To remediate this issue, users are recommended to update to...
CVE-2025-70073
An issue in ChestnutCMS v.1.5.8 and before allows a remote attacker to execute arbitrary code via the template creation function...
PT-2026-6558
Name of the Vulnerable Software and Affected Versions Thales SafeNet Agent for Windows Logon versions 4.0.0 through 4.1.2 Description A flaw exists in the certificate validation process within SafeNet Agent for Windows Logon on Windows, potentially enabling signature spoofing. This issue stems fr...