CVE-2023-45134 XWiki Platform XSS vulnerability from account in the create page form via template provider

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. org.xwiki.platform:xwiki-platform-web starting in version 3.1-milestone-1 and prior to 13.4-rc-1, org.xwiki.platform:xwiki-platform-web-templates prior to versions 14.10.2 and 15.5-rc-1, and...

CVE-2023-45753

Cross-Site Request Forgery CSRF vulnerability in Gilles Dumas which template file plugin = 4.6.0 versions...

CVE-2023-45753

Cross-Site Request Forgery CSRF vulnerability in Gilles Dumas which template file plugin = 4.6.0 versions...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in Gilles Dumas which template file plugin = 4.6.0 versions...

CVE-2023-45753 WordPress which template file Plugin <= 4.6.0 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Gilles Dumas which template file plugin = 4.6.0 versions...

CVE-2023-45753

CVE-2023-45753 pertains to the WordPress plugin “which template file” (plugin versions

WordPress Plugin which template file cross-site request forgery vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

PT-2023-29244 · Openrapid · Openrapid Rapidcms

Name of the Vulnerable Software and Affected Versions: OpenRapid RapidCMS version 1.3.1 Description: A critical issue was found in OpenRapid RapidCMS, affecting the file template/default/category.php. The manipulation of the id argument leads to SQL injection. Recommendations: For OpenRapid...

Desdev DedeCMS 代码注入漏洞

Desdev DedeCMS Dream Weaving Content Management System is a PHP-based open-source content management system CMS of China Zhuozhuo network Desdev company. The system has the functions of content publishing, content management, content editing and content retrieval. A security vulnerability exists ...

CLTPHP 输入验证错误漏洞

CLTPHP is an open source and efficient site-building PHP content management system. An input validation error vulnerability exists in CLTPHP version 6.0 and earlier versions, which stems from incorrect input validation in application/admin/controller/Template.php. An attacker can exploit this...

PT-2023-20892 · Atutor · Atutor

Name of the Vulnerable Software and Affected Versions: ATutor version 2.2.1 Description: A Cross-site scripting XSS issue exists in the encrypt password function in login.tmpl.php, allowing remote attackers to inject arbitrary web script or HTML via the token parameter. Recommendations: For ATuto...

PT-2023-16524 · Ecshop · Ecshop

Name of the Vulnerable Software and Affected Versions: EcShop version 4.1.5 Description: A critical issue affects the PHP File Handler component, specifically the /ecshop/admin/template.php file, leading to unrestricted upload. The attack can be initiated remotely. Recommendations: For EcShop...

MISP 跨站脚本漏洞

MISP is an open source software solution. The product is used to collect, store, distribute, and share cybersecurity metrics and has features such as threat cybersecurity event analysis and malware analysis. A security vulnerability exists in MISP versions prior to 2.4.167, which stems from XSS i...

Cobbler is vulnerable to code injection

templateapi.py in Cobbler before 2.0.7, as used in Red Hat Network Satellite Server and other products, does not disable the ability of the Cheetah template engine to execute Python statements contained in templates, which allows remote authenticated administrators to execute arbitrary code via a...

Improper Control of Generation of Code ('Code Injection')

CVE-2010-2235 RHN Satellite cobbler: Code injection flaw ACE as root by processing of a specially-crafted kickstart template file...

Xxe

GE Gas Power ToolBoxST Version v04.07.05C suffers from an XML external entity XXE vulnerability using the DTD parameter entities technique that could result in disclosure and retrieval of arbitrary data on the affected node via an out-of-band OOB attack. The vulnerability is triggered when input...

CVE-2022-23881

ZZZCMS zzzphp v2.1.0 was discovered to contain a remote command execution RCE vulnerability via dangerkey at zzztemplate.php...

CVE-2021-45380

AppCMS 2.0.101 has a XSS injection vulnerability in \templates\m\inchead.php...

Security Update for Microsoft Power BI Report Server (November 2021)

A Cross-Site Scripting XSS and Cross-Site Request Forgery CSRF vulnerability exists when Power BI Report Server Template file pbix containing HTML files is uploaded to the server and HTML files are accessed directly by the victim. Combining these 2 vulnerabilities together, an attacker is able to...

Cross site request forgery (csrf)

A Cross-Site Scripting XSS and Cross-Site Request Forgery CSRF vulnerability exists when Power BI Report Server Template file pbix containing HTML files is uploaded to the server and HTML files are accessed directly by the victim. Combining these 2 vulnerabilities together, an attacker is able to...