CVE-2023-28447 Cross site scripting vulnerability in Javascript escaping in smarty/smarty

Smarty is a template engine for PHP. In affected versions smarty did not properly escape javascript code. An attacker could exploit this vulnerability to execute arbitrary JavaScript code in the context of the user's browser session. This may lead to unauthorized access to sensitive user data,...

CVE-2023-28447

Smarty, a PHP templating engine, is affected by CVE-2023-28447 due to improper escaping of JavaScript code in affected versions. This could allow an attacker to execute arbitrary JavaScript in the context of a user’s browser session, potentially leading to unauthorized access to sensitive data, m...

Smarty 跨站脚本漏洞

Smarty is a PHP-based template engine that facilitates the separation of representation HTML/CSS from application logic. A cross-site scripting vulnerability exists in Smarty versions prior to 4.3.1 and 3.1.48, which stems from not properly escaping javascript code. An attacker can exploit this...

PT-2023-21728

Name of the Vulnerable Software and Affected Versions Smarty versions prior to 3.1.48 Smarty versions prior to 4.3.1 Description The issue is related to improper escaping of JavaScript code in the Smarty template engine for PHP. An attacker could exploit this to execute arbitrary JavaScript code ...

Debian: Security Advisory (DLA-452-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Remote Code Execution (RCE)

nautobot is vulnerable to Remote Code Execution RCE. The vulnerability is due to improper sandboxing of environments for the Jinja2 template engine when used internally for template rendering for objects like extras.ComputedField,extras.CustomLink, extras.ExportTemplate, extras.Secret and...

PYSEC-2023-37

Nautobot is a Network Source of Truth and Network Automation Platform. All users of Nautobot versions earlier than 1.5.7 are impacted by a remote code execution vulnerability. Nautobot did not properly sandbox Jinja2 template rendering. In Nautobot 1.5.7 has enabled sandboxed environments for the...

CVE-2023-25657

Summary: CVE-2023-25657 affects Nautobot before 1.5.7, where the Jinja2 template engine was not sandboxed, potentially enabling remote code execution. In Nautobot 1.5.7 and later, sandboxed environments are enabled for Jinja2 rendering for objects such as extras.ComputedField, extras.CustomLink, ...

SUSE CVE-2010-2235

templateapi.py in Cobbler before 2.0.7, as used in Red Hat Network Satellite Server and other products, does not disable the ability of the Cheetah template engine to execute Python statements contained in templates, which allows remote authenticated administrators to execute arbitrary code via a...

SUSE CVE-2015-1159

Cross-site scripting XSS vulnerability in the cgiputs function in cgi-bin/template.c in the template engine in CUPS before 2.0.3 allows remote attackers to inject arbitrary web script or HTML via the QUERY parameter to help/...

SUSE CVE-2016-10745

In Pallets Jinja before 2.8.1, str.format allows a sandbox escape...

Kardex Control Center 代码注入漏洞

Kardex Control Center is a logistics control and warehouse management system from Kardex Corporation. A security vulnerability exists in Kardex Control Center version 5.7.12+0-a203c2a213-master, which stems from user-controllable paths being passed to the path-concatenation method without proper...

Remote Code Execution (RCE)

psiturk is vulnerable to Remote Code Execution. The vulnerability exists in experiment.py due to the improper sanitization of special elements used as the template engine, which allows a remote attacker to inject and execute arbitrary Python commands...

Eta 跨站脚本漏洞

Eta is Eta open source a lightweight , fast embedded JS template engine . Can run in Node, Deno and browser . A cross-site scripting vulnerability exists in Eta. An attacker could exploit this vulnerability to perform cross-site scripting attacks...

GHSA-6C25-CXCC-PMC4 Dromara hutool vulnerable to SQL Injection

SQL Inection vulnerability in Dromara hutool v5.8.11 allows attacker to execute arbitrary code via the aviator template engine...

Dromara hutool vulnerable to SQL Injection

SQL Inection vulnerability in Dromara hutool v5.8.11 allows attacker to execute arbitrary code via the aviator template engine...

CVE-2023-24163

SQL Inection vulnerability in Dromara hutool before 5.8.21 allows attacker to execute arbitrary code via the aviator template engine...

Sql injection

SQL Inection vulnerability in Dromara hutool v5.8.11 allows attacker to execute arbitrary code via the aviator template engine...

PT-2023-19451 · Dromara · Hutool

Name of the Vulnerable Software and Affected Versions: Dromara hutool versions prior to 5.8.21 Description: The issue allows an attacker to execute arbitrary code via the aviator template engine. This is a SQL Injection vulnerability. Recommendations: For versions prior to 5.8.21, update to versi...

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

SQL Inection vulnerability in Dromara hutool v5.8.11 allows attacker to execute arbitrary code via the aviator template engine...