827 matches found
PT-2024-8602 · Apache · Apache Ofbiz
Name of the Vulnerable Software and Affected Versions: Apache OFBiz versions prior to 18.12.17 Description: The issue is related to improper control of code generation, allowing for code injection, and also involves cross-site request forgery CSRF and improper neutralization of special elements...
CVE-2024-52393
Deserialization of Untrusted Data vulnerability in Eric Teubert Podlove Podcast Publisher podlove-podcasting-plugin-for-wordpress.This issue affects Podlove Podcast Publisher: from n/a through = 4.1.15...
CVE-2024-52393
CVE-2024-52393 affects the WordPress Podlove Podcast Publisher plugin up to version 4.1.15, with an Admin+ Remote Code Execution (RCE) vector due to Improper Neutralization of Special Elements Used in a Template Engine . Multiple sources (including Patchstack) corroborate the RCE impact and refer...
CVE-2024-52393 WordPress Podlove Podcast Publisher plugin <= 4.1.15 - Admin+ Remote Code Execution (RCE) vulnerability
Deserialization of Untrusted Data vulnerability in Eric Teubert Podlove Podcast Publisher podlove-podcasting-plugin-for-wordpress.This issue affects Podlove Podcast Publisher: from n/a through = 4.1.15...
CVE-2024-52393 WordPress Podlove Podcast Publisher plugin <= 4.1.15 - Admin+ Remote Code Execution (RCE) vulnerability
Deserialization of Untrusted Data vulnerability in Eric Teubert Podlove Podcast Publisher podlove-podcasting-plugin-for-wordpress.This issue affects Podlove Podcast Publisher: from n/a through = 4.1.15...
PT-2024-35231 · Unknown · Podlove Podcast Publisher
Name of the Vulnerable Software and Affected Versions: Podlove Podcast Publisher versions through 4.1.15 Description: The issue is related to an Improper Neutralization of Special Elements Used in a Template Engine vulnerability. This vulnerability allows for remote attacks due to flaws in the...
RHEL 9 : python-jinja2 (RHSA-2024:9150)
The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:9150 advisory. The python-jinja2 package contains Jinja2, a template engine written in pure Python. Jinja2 provides a Django inspired non-XML syntax but supports...
Protection Mechanism Failure
Overview twig/twig is a flexible, fast, and secure template language for PHP. Affected versions of this package are vulnerable to Protection Mechanism Failure in a sandbox due to improper object validation in the ensureToStringAllowed function. An attacker can invoke the toString method on an...
CVE-2024-49271
: Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates allows : Command Injection.This issue affects Unlimited Elements For Elementor Free Widgets, Addons, Templates: from n/a...
CVE-2024-48042
Deserialization of Untrusted Data vulnerability in supsystic Contact Form by Supsystic contact-form-by-supsystic allows Command Injection.This issue affects Contact Form by Supsystic: from n/a through = 1.7.28...
WordPress plugin Unlimited Elements For Elementor 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...
PT-2024-33410 · Elementor · Unlimited Elements For Elementor
Name of the Vulnerable Software and Affected Versions: Unlimited Elements For Elementor versions 1.5.121 and earlier Description: The issue is related to an Improper Neutralization of Special Elements Used in a Template Engine, which allows Command Injection. This means that an attacker could...
PT-2024-32961
Name of the Vulnerable Software and Affected Versions Supsystic Contact Form versions 1.7.28 and earlier Description The issue is related to an Improper Neutralization of Special Elements Used in a Template Engine vulnerability, which allows Command Injection. This can lead to potential cyber...
changedetection.io has a Server Side Template Injection using Jinja2 which allows Remote Command Execution
Summary A Server Side Template Injection in changedetection.io caused by usage of unsafe functions of Jinja2 allows Remote Command Execution on the server host. Details changedetection.io version: 0.45.20 docker images REPOSITORY TAG IMAGE ID CREATED SIZE dgtlmoon/changedetection.io latest...
Exploit for Code Injection in Sqlpad
CVE-2022-0944 PoC PoC for RCE in SQLPad. This example spawns a...
Debian dsa-5771 : php-twig - security update
The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5771 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-5771-1 [email protected] https://www.debian.org/security/ Moritz...
Exploit for Code Injection in Sqlpad
SQLPad RCE Exploit This repository contains an exploit script...
Exploit for Code Injection in Sqlpad
I am not the researcher w...
Twig 安全漏洞
Twig is a PHP template engine open-sourced by Twig. A security vulnerability exists in Twig that stems from the fact that sandbox security checks will not be run under certain circumstances, allowing user-contributed templates to bypass sandbox restrictions...