CVE-2020-19151

Command Injection in Jfinal CMS v4.7.1 and earlier allows remote attackers to execute arbitrary code by uploading a malicious HTML template file via the component 'jfinalcms/admin/filemanager/list'...

Command injection

Command Injection in Jfinal CMS v4.7.1 and earlier allows remote attackers to execute arbitrary code by uploading a malicious HTML template file via the component 'jfinalcms/admin/filemanager/list'...

CVE-2021-34638

Authenticated Directory Traversal in WordPress Download Manager = 3.1.24 allows authenticated Contributor+ users to obtain sensitive configuration file information, as well as allowing Author+ users to perform XSS attacks, by setting Download template to a file containing configuration informatio...

OESA-2021-1122 velocity-tools security update

The VelocityTools project is a collection of useful Java classes aka tools, as well as infrastructure to easily, automatically and transparently make these tools available to Velocity templates. Project include easy integration of Velocity into the view-layer of web applications via the...

Zen Ventures Zen Cart 跨站脚本漏洞

Zen Cart is open source, free mall system for building professional online stores. A reflective cross-site scripting vulnerability exists in Zen Cart 1.5.6d. An attacker can execute malicious script via the includes/templates/templatedefault/common/tplmainpage.php or...

UBUNTU-CVE-2020-25286

In wp-includes/comment-template.php in WordPress before 5.4.2, comments from a post or page could sometimes be seen in the latest comments even if the post or page was not public...

YMBCMS management system template file upload vulnerability

Hebei OuRunTianTeng Science and Technology Development Co., Ltd. is an Internet enterprise focusing on the development of five stations in one "computer website + mobile website + WeChat public platform + APP + small program" service for enterprises. YMBCMS management system template file upload...

QCMS Arbitrary File Read Vulnerability

QCMS is an open source content management system CMS for creating responsive websites from China's Velvet Ease Technology Corporation. A security vulnerability exists in the system/controller/backend/template.php file in the QCMS v3.0.1 version of VelvetEase Technology. An attacker can exploit th...

CVE-2020-10578

An arbitrary file read vulnerability exists in system/controller/backend/template.php in QCMS v3.0.1...

Eyoucms children's clothing foreign trade responsive English website template file upload vulnerability

Eyoucms is based on TP5.0 framework for the core development of free + open source enterprise content management system . Children's foreign trade responsive English website template comes with eyoucms core. Eyoucms children's clothing responsive English website template file upload vulnerability...

OpenEMR Cross-Site Scripting Vulnerability (CNVD-2019-41603)

OpenEMR is an open source medical management system from the OpenEMR community. The system can be used for medical practice management, electronic medical records, prescription writing and medical billing requests. A cross-site scripting vulnerability exists in the...

CVE-2019-17368

S-CMS v1.5 has XSS in tpl.php via the member/memberlogin.php from parameter...

OFCMS Background Command Execution Vulnerability

OFCMS is a content management system based on Java technology. A background command execution vulnerability exists in versions of OFCMS prior to 1.1.3. The vulnerability can be exploited to execute commands via a template file with ' $ ex"' followed by the command...

Command injection

An issue was discovered in OFCMS before 1.1.3. A command execution vulnerability exists via a template file with ' $ ex"' followed by the command...

CVE-2019-9614

An issue was discovered in OFCMS before 1.1.3. A command execution vulnerability exists via a template file with ' $ ex"' followed by the command...

CVE-2019-9614

An issue was discovered in OFCMS before 1.1.3. A command execution vulnerability exists via a template file with ' $ ex"' followed by the command...

zzzphp CMS 1.6.1 - Cross-Site Request Forgery

zzzphp CMS 1.6.1 - Cross-Site Request Forgery Exploit Title: Cross-Site Request ForgeryCSRF of zzzphp cms 1.6.1 Google Dork: intext:"2015-2019 zzcms.com" Date: 26/02/2019 Exploit Author: Yang Chenglong Vendor Homepage: http://www.zzzcms.com/index.html Software Link: http://115.29.55.18/zzzphp.zip...

ZZZPHP CMS 1.6.1 Remote Code Execution

Exploit Title: dynamic code evaluation of zzzphp cms 1.6.1 Google Dork: intext:"2015-2019 zzcms.com" Date: 24/02/2019 Exploit Author: Yang Chenglong Vendor Homepage: http://www.zzzcms.com/index.html Software Link: http://115.29.55.18/zzzphp.zip Version: 1.6.1 Tested on: windows/Linux,iis/apache C...

CVE-2019-9041

An issue was discovered in ZZZCMS zzzphp V1.6.1. In the inc/zzztemplate.php file, the parserIfLabel function's filtering is not strict, resulting in PHP code execution, as demonstrated by the if:assert substring...

CVE-2018-19907

A Server-Side Template Injection issue was discovered in Crafter CMS 3.0.18. Attackers with developer privileges may execute OS commands by Creating/Editing a template file .ftl filetype that triggers a call to freemarker.template.utility.Execute in the FreeMarker library during rendering of a we...