Rockstar Games: stored XSS (angular injection) in support.rockstargames.com using zendesk register form via name parameter

In this report, the researcher discovered that registering for our Support site using the Zendesk Registration Form allowed for entering an AngularJS Template Injection payload as the Username. This could have allowed an attacker to perform Stored XSS attacks or similar. We deployed a fix for thi...

GxlcmsQY update function arbitrary PHP code execution vulnerability

GxlcmsQY system is a quick website cms tailored for business users. An arbitrary PHP code execution vulnerability exists in the update function in LibLibActionAdminTplAction.class.php in Gxlcms QY v1.0.0713. A remote attacker can exploit this vulnerability by placing code in a template to execute...

CVE-2018-9847: Improper Control of Generation of Code

In Gxlcms QY v1.0.0713, the update function in Lib\Lib\Action\Admin\TplAction.class.php allows remote attackers to execute arbitrary PHP code by placing this code into a template...

Shopware Server Side Template Injection RCE

Remote command execution vulnerability in Shopware getTemplateName Vulnerability Type: Remote Command Execution For the exploit source code contact DSquare Security sales team...

192.168.0.172 (4.6.1), 2d-json-schema-editor-visual (>=1.0.2, <=1.0.7) +620 more potentially affected by CVE-2017-1000189 via ejs (>=2.0.8, <=2.5.4)

ejs NPM version =2.0.8, =1.0.2, =0.0.1, =0.1.0, =0.1.0, =0.1.8, =1.0.0, =1.0.1, =0.1.9, =0.1.14 - @mobileit/sails 0.12.14 and more Source cves: CVE-2017-1000189 Source advisory: OSV:GHSA-6X77-RPQF-J6MW...

CVE-2018-7663

An issue was discovered in resources/views/layouts/app.blade.php in Voten.co before 2017-08-25. An unescaped template literal in the bio field of a user profile resources/views/layouts/app.blade.php allows for server-side template injection of arbitrary JavaScript...

CVE-2018-7663

An issue was discovered in resources/views/layouts/app.blade.php in Voten.co before 2017-08-25. An unescaped template literal in the bio field of a user profile resources/views/layouts/app.blade.php allows for server-side template injection of arbitrary JavaScript...

CVE-2018-7663

CVE-2018-7663 concerns Voten.co before 2017-08-25, where an unescaped template literal in the bio field of a user profile (in resources/views/layouts/app.blade.php) enables server-side template injection of arbitrary JavaScript. Multiple sources (NVD/NVD-derived records, CNVD) confirm the issue a...

CVE-2018-7663

An issue was discovered in resources/views/layouts/app.blade.php in Voten.co before 2017-08-25. An unescaped template literal in the bio field of a user profile resources/views/layouts/app.blade.php allows for server-side template injection of arbitrary JavaScript...

CVE-2018-7663

An issue was discovered in resources/views/layouts/app.blade.php in Voten.co before 2017-08-25. An unescaped template literal in the bio field of a user profile resources/views/layouts/app.blade.php allows for server-side template injection of arbitrary JavaScript...

PT-2018-18194

Name of the Vulnerable Software and Affected Versions Voten.co versions prior to 2017-08-25 Description An issue was discovered in the bio field of a user profile, allowing for server-side template injection of arbitrary JavaScript due to an unescaped template literal in...

CVE-2018-7663: Improper Neutralization of Input During Web Page Generation

An issue was discovered in resources/views/layouts/app.blade.php in Voten.co before 2017-08-25. An unescaped template literal in the bio field of a user profile resources/views/layouts/app.blade.php allows for server-side template injection of arbitrary JavaScript...

Node.js third-party modules: [bracket-template] Reflected XSS possible when variable passed via GET parameter is used in template

Hi Guys, I would like to report Reflected XSS in bracket-template module. It allows to inject arbitrary JavaScript tag and malicious code to execute when variables read from GET are used directly in template without sanitization. Module module name: bracket-template version: 1.1.5 npm page:...

Twig Server Side Template Injection

Vulnerability details: Exploit Title: Twig Output: 16 2. POC: http://localhost/search?searchkey=44 OUTPUT: 4 http://localhost/search?searchkey=ls OUTPUT: list of files/directories etca|...

Twig 2.4.4 - Server Side Template Injection

Twig 2.4.4 - Server Side Template Injection Vulnerability details: Exploit Title: Twig Output: 16 2. POC: http://localhost/search?searchkey=44 OUTPUT: 4 http://localhost/search?searchkey=ls OUTPUT: list of files/directories etc…...

HubSpot: Reflected XSS and Server Side Template Injection in all HubSpot CMSes

Really I don't know why BugCrowd team closed my submission as N/A F337815 They mentioned that Not in Scope ?! So I reported it again in another submission But this Time I messaged the Security Company Directly and triaged and Fixed in 2 Days . Full Poc : I was found in this path /hcms/cta so this...

CVE-2017-1000454

CMS Made Simple 2.1.6, 2.2, 2.2.1 are vulnerable to Smarty Template Injection in some core components, resulting in local file read before 2.2, and local file inclusion since 2.2.1...

Design/Logic Flaw

CMS Made Simple 2.1.6, 2.2, 2.2.1 are vulnerable to Smarty Template Injection in some core components, resulting in local file read before 2.2, and local file inclusion since 2.2.1...

CVE-2017-1000454

CMS Made Simple 2.1.6, 2.2, 2.2.1 are vulnerable to Smarty Template Injection in some core components, resulting in local file read before 2.2, and local file inclusion since 2.2.1...

CVE-2017-1000454

CMS Made Simple 2.1.6, 2.2, 2.2.1 are vulnerable to Smarty Template Injection in some core components, resulting in local file read before 2.2, and local file inclusion since 2.2.1...