CVE-2025-64200: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in VillaTheme Email Template Customizer for WooCommerce email-template-customizer-for-woo allows Stored XSS.This issue affects Email Template Customizer for WooCommerce: from n/a through = 1.2.17...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the SharpShowTextField component when rendering user-supplied input containing Vue template syntax. An attacker can execute arbitrary JavaScript or inject malicious HTML by submitting specially crafted...

CVE-2025-62798 Sharp user-provided input can be evaluated in a SharpShowTextField with Vue template syntax

Sharp is a content management framework built for Laravel as a package. Prior to 9.11.1, a Cross-Site Scripting XSS vulnerability was discovered in code16/sharp when rendering content using the SharpShowTextField component. In affected versions, expressions wrapped in & were evaluated by Vue. Thi...

CVE-2025-62798 Sharp user-provided input can be evaluated in a SharpShowTextField with Vue template syntax

Sharp is a content management framework built for Laravel as a package. Prior to 9.11.1, a Cross-Site Scripting XSS vulnerability was discovered in code16/sharp when rendering content using the SharpShowTextField component. In affected versions, expressions wrapped in & were evaluated by Vue. Thi...

CVE-2025-62798 Sharp user-provided input can be evaluated in a SharpShowTextField with Vue template syntax

Sharp is a content management framework built for Laravel as a package. Prior to 9.11.1, a Cross-Site Scripting XSS vulnerability was discovered in code16/sharp when rendering content using the SharpShowTextField component. In affected versions, expressions wrapped in & were evaluated by Vue. Thi...

CVE-2025-62798

The CVE-2025-62798 issue affects the code16/sharp package (Sharp) used with Laravel, specifically the SharpShowTextField component. In vulnerable versions prior to 9.11.1, Vue evaluated expressions wrapped in {{ ... }} when rendering content, allowing attacker-controlled input to execute arbitrar...

EUVD-2025-36547

zhangyd-c OneBlog before 2.3.9 was vulnerable to SSTI Server-Side Template Injection via FreeMarker templates...

CVE-2025-60355

zhangyd-c OneBlog v2.3.9 and before was vulnerable to SSTI Server-Side Template Injection via FreeMarker templates...

CVE-2025-60355

zhangyd-c OneBlog v2.3.9 and before was vulnerable to SSTI Server-Side Template Injection via FreeMarker templates...

OneBlog security vulnerabilities

OneBlog is a beautiful and powerful Java blog by yadong.zhang individual developer. A security vulnerability exists in OneBlog versions prior to 2.3.9, which stems from a server-side template injection in FreeMarker templates...

CVE-2025-60355

zhangyd-c OneBlog v2.3.9 and before was vulnerable to SSTI Server-Side Template Injection via FreeMarker templates...

CVE-2025-60355

zhangyd-c OneBlog v2.3.9 and before was vulnerable to SSTI Server-Side Template Injection via FreeMarker templates...

XWiki Platform HTTP Meta Info SSTI

The vulnerability of the HTTP Meta Info field in the administration interface of the XWiki Platform involves a lack of measures taken to protect the website structure. Exploiting this vulnerability could allow an attacker, operating remotely, to execute a Server Side Template Injection SSTI attac...

CVE-2025-60355

zhangyd-c OneBlog v2.3.9 and before was vulnerable to SSTI Server-Side Template Injection via FreeMarker templates...

CVE-2025-60355

The zhangyd-c OneBlog Java blog (versions v2.3.9 and before ) is vulnerable to Server-Side Template Injection (SSTI) via FreeMarker templates . This vulnerability occurs due to the improper neutralization of special elements used in the template engine, which can allow an attacker to inject malic...

PT-2025-44194

Name of the Vulnerable Software and Affected Versions zhangyd-c OneBlog versions prior to 2.3.9 Description The software is susceptible to Server-Side Template Injection SSTI through FreeMarker templates. SSTI allows an attacker to inject malicious code into the server, potentially leading to...

Cross-site Scripting

dotnetnuke.core is vulnerable to Cross-site Scripting XSS. The vulnerability is due to improper encoding of user input in URL and template rendering, allowing attackers to inject malicious scripts that execute in victims’ browsers...

CVE-2024-6690

creationtimestamp| type| source ---|---|--- 2025-10-27 01:52:34+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2024/CVE-2024-6690.yaml 2025-10-27 21:02:34+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3m47cvwti532k 2025-12-02...

CVE-2025-62958: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Clifton Griffin Simple Content Templates for Blog Posts & Pages simple-post-template allows Cross Site Request Forgery.This issue affects Simple Content Templates for Blog Posts & Pages: from n/a through = 2.2.61...

CVE-2025-12072

The Disable Content Editor For Specific Template plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0. This is due to missing nonce validation on template configuration updates. This makes it possible for unauthenticated attackers to add or...