Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the TemplateNotificationMessageGenerator. An attacker can gain unauthorized access to restricted information from expandoTableLocalService by sending crafted requests to the affected service. Remediation Upgrad...

MAL-2025-41813 Malicious code in react-media-template-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 5a2fff48804ddfb5297954a2040eb8f90fd5ca36c31568a46d56d860ecf47148 The OpenSSF Package Analysis project identified 'react-media-template-ts' @ 10.0.1 npm as malicious. It is considered malicious because: - The...

Malicious code in react-media-template-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 5a2fff48804ddfb5297954a2040eb8f90fd5ca36c31568a46d56d860ecf47148 The OpenSSF Package Analysis project identified 'react-media-template-ts' @ 10.0.1 npm as malicious. It is considered malicious because: - The...

OESA-2025-2084 gnutls security update

GnuTLS is a secure communications library implementing the SSL, TLS and DTLS protocols and technologies around them. It provides a simple C language application programming interface API to access the secure communications protocols as well as APIs to parse and write X.509, PKCS 12, and other...

CVE-2025-9591

A security vulnerability has been detected in ZrLog up to 3.1.5. This vulnerability affects unknown code of the file /api/admin/template/config of the component Theme Configuration Form. Such manipulation of the argument footerLink leads to cross site scripting. The attack may be launched remotel...

ZrLog security vulnerabilities

ZrLog is a blogging system developed in Java language by xiaochun individual developer. A security vulnerability exists in ZrLog 3.1.5 and earlier versions, which stems from cross-site scripting due to incorrect manipulation of the parameter footerLink in the file /api/admin/template/config...

CVE-2025-58208

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in add-ons.org PDF for Elementor Forms + Drag And Drop Template Builder pdf-for-elementor-forms allows Stored XSS.This issue affects PDF for Elementor Forms + Drag And Drop Template Builder: from n/a...

CVE-2025-58208 WordPress PDF for Elementor Forms + Drag And Drop Template Builder Plugin <= 6.2.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in add-ons.org PDF for Elementor Forms + Drag And Drop Template Builder pdf-for-elementor-forms allows Stored XSS.This issue affects PDF for Elementor Forms + Drag And Drop Template Builder: from n/a...

CVE-2025-58208

The CVE-2025-58208 entry concerns a Stored Cross-Site Scripting (XSS) in the WordPress plugin PDF for Elementor Forms + Drag And Drop Template Builder (versions up to 6.2.0). The root cause is improper input neutralization during web page generation, enabling stored XSS to affect pages generated ...

CVE-2025-50977

A template injection vulnerability leading to reflected cross-site scripting XSS has been identified in version 1.7.1, requiring authenticated admin access for exploitation. The vulnerability exists in the 'r' parameter and allows attackers to inject malicious Angular expressions that execute...

The Freeform CraftCMS plugin contains an Server-side template injection (SSTI) vulnerability

Freeform 5.0.0 to before 5.10.16, a plugin for CraftCMS, contains an Server-side template injection SSTI vulnerability, resulting in arbitrary code injection for all users that have access to editing a form submission title...

GHSA-9HP3-F5G8-RCCG The Freeform CraftCMS plugin contains an Server-side template injection (SSTI) vulnerability

Freeform 5.0.0 to before 5.10.16, a plugin for CraftCMS, contains an Server-side template injection SSTI vulnerability, resulting in arbitrary code injection for all users that have access to editing a form submission title...

CVE-2025-52122

Freeform 5.0.0 to before 5.10.16, a plugin for CraftCMS, contains an Server-side template injection SSTI vulnerability, resulting in arbitrary code injection for all users that have access to editing a form submission title...

CVE-2025-50972

SQL Injection vulnerability in AbanteCart 1.4.2, allows unauthenticated attackers to execute arbitrary SQL commands via the tmplid parameter to index.php. Three techniques have been demonstrated: error-based injection using a crafted FLOOR-based payload, time-based blind injection via SLEEP, and...

Server-Side Template Injection

Overview solspace/craft-freeform is a flexible and user-friendly form building plugin! Affected versions of this package are vulnerable to Server-Side Template Injection via the submission's title variable. An attacker can execute arbitrary code on the server by injecting malicious templates when...

CVE-2025-50977

A template injection vulnerability leading to reflected cross-site scripting XSS has been identified in version 1.7.1, requiring authenticated admin access for exploitation. The vulnerability exists in the 'r' parameter and allows attackers to inject malicious Angular expressions that execute...

CVE-2025-58208: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in add-ons.org PDF for Elementor Forms + Drag And Drop Template Builder pdf-for-elementor-forms allows Stored XSS.This issue affects PDF for Elementor Forms + Drag And Drop Template Builder: from n/a...

CVE-2025-52122

The Freeform plugin for CraftCMS (versions 5.0.0 to before 5.10.16 ) is vulnerable to Server-side template injection (SSTI) . The root cause is the improper handling of user input where the plugin implements a "call" Twig filter without sufficient validation on the form submission title field. An...

CVE-2025-50972

The open-source e-commerce platform AbanteCart version 1.4.2 is vulnerable to a SQL Injection vulnerability. This flaw stems from an unvalidated tmpl_id parameter in the index.php file, which allows unauthenticated attackers to execute arbitrary SQL commands. Demonstrated exploitation techniques ...

CVE-2025-50977

A template injection vulnerability leading to reflected cross-site scripting XSS has been identified in version 1.7.1, requiring authenticated admin access for exploitation. The vulnerability exists in the 'r' parameter and allows attackers to inject malicious Angular expressions that execute...