19668 matches found
CVE-2025-61229
Connected documents confirm a concrete vulnerability in Shirt Pocket’s SuperDuper!
CVE-2025-61229
An issue in Shirt Pocket's SuperDuper! 3.10 and earlier allow a local attacker to modify the default task template to execute an arbitrary preflight script with root privileges and Full Disk Access, thus bypassing macOS privacy controls...
Angular cross-site scripting vulnerabilities
Angular is a development platform of Angular open source. It is used to build mobile and desktop web applications using Typescript / JavaScript and other languages. A cross-site scripting vulnerability exists in Angular versions prior to 21.0.2, prior to 20.3.15, and prior to 19.2.17, which stems...
PT-2025-48578
Name of the Vulnerable Software and Affected Versions Angular versions prior to 21.0.2 Angular versions prior to 20.3.15 Angular versions prior to 19.2.17 Description A Stored Cross-Site Scripting XSS issue exists in the Angular Template Compiler due to an incomplete internal security schema. Thi...
Grav CMS Twig SSTI Authenticated Sandbox Bypass RCE
This module exploits a Server-Side Template Injection SSTI vulnerability CVE-2025-66294 in Grav CMS that allows bypassing the Twig sandbox to achieve remote code execution. The cleanDangerousTwig method uses weak regex that fails to sanitize nested Twig calls within the evaluatetwig function. To...
Grav security vulnerabilities
Grav is an extensible CMS Content Management System for personal blogs, small content publishing platforms and one-page product presentations. Grav suffers from a server-side template injection vulnerability that can be exploited by an attacker to cause disclosure of the entire Grav configuration...
PT-2025-48448
Eximbills Enterprise 4.1.5 Built on 2020-10-30 is vulnerable to authenticated stored cross-site scripting CWE-79 via the /EximBillWeb/servlets/WSTrxManager endpoint. Unsanitized user input in the TMPL INFO parameter is stored server-side and rendered to other users, enabling arbitrary JavaScript...
CVE-2025-66294: Improper Control of Generation of Code
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a Server-Side Template Injection SSTI vulnerability exists in Grav that allows authenticated attackers with editor permissions to execute arbitrary commands on the server and, under certain conditions, may also be exploited by...
CVE-2025-64030
Eximbills Enterprise 4.1.5 Built on 2020-10-30 is vulnerable to authenticated stored cross-site scripting CWE-79 via the /EximBillWeb/servlets/WSTrxManager endpoint. Unsanitized user input in the TMPLINFO parameter is stored server-side and rendered to other users, enabling arbitrary JavaScript...
CVE-2025-61229
An issue in Shirt Pocket's SuperDuper! 3.10 and earlier allow a local attacker to modify the default task template to execute an arbitrary preflight script with root privileges and Full Disk Access, thus bypassing macOS privacy controls...
CVE-2025-64030
Eximbills Enterprise version 4.1.5 (Built on 2020-10-30) is vulnerable to authenticated stored cross-site scripting (CWE-79) . The issue occurs via the /EximBillWeb/servlets/WSTrxManager endpoint due to unsanitized user input in the TMPL_INFO parameter. This input is stored server-side and render...
CVE-2023-41954
creationtimestamp| type| source ---|---|--- 2025-11-29 23:34:16+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2023/CVE-2023-41954.yaml 2025-12-01 21:02:38+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3m6xda5caqj2w 2026-09-21...
CVE-2021-36888
creationtimestamp| type| source ---|---|--- 2025-11-29 19:45:46+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-36888.yaml 2025-12-01 21:02:33+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3m6xda4o4qo2a 2026-06-23...
CVE-2020-11732
creationtimestamp| type| source ---|---|--- 2025-11-29 19:01:22+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2020/CVE-2020-11732.yaml 2025-12-01 21:02:32+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3m6xda4l4f62f...
CVE-2025-40890
A Stored Cross-Site Scripting vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter. An authenticated low-privilege user can craft a malicious dashboard containing a JavaScript payload and share it with victim users, or a victim can be...
container-tools:rhel8 security and bug fix update
An update is available for libslirp, module.libslirp. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The container-tools module contains tools for working with...
RLSA-2023:6938 Moderate: container-tools:4.0 security and bug fix update
The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fixes: go-yaml: Improve heuristics preventing CPU/memory abuse by parsing malicious or large YAML documents CVE-2022-3064 golang: html/template: improper handling of JavaScri...
RLSA-2023:6939 Moderate: container-tools:rhel8 security and bug fix update
The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fixes: go-yaml: Improve heuristics preventing CPU/memory abuse by parsing malicious or large YAML documents CVE-2022-3064 golang: html/template: improper handling of JavaScri...
Elastic Cloud Enterprise analytics Template Injection Code Execution
The vulnerability of the Elastic Cloud Enterprise analytics platform lies in the lack of measures to neutralize special elements in the template creation mechanism. Exploiting this vulnerability can allow a malicious actor to gain access to confidential information and execute arbitrary code...
CVE-2025-64050
A Remote Code Execution RCE vulnerability in the template management component in REDAXO CMS 5.20.0 allows remote authenticated administrators to execute arbitrary operating system commands by injecting PHP code into an active template. The payload is executed when visitors access frontend pages...