Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the SharpShowTextField component when rendering user-supplied input containing Vue template syntax. An attacker can execute arbitrary JavaScript or inject malicious HTML by submitting specially crafted...

CVE-2025-62798 Sharp user-provided input can be evaluated in a SharpShowTextField with Vue template syntax

Sharp is a content management framework built for Laravel as a package. Prior to 9.11.1, a Cross-Site Scripting XSS vulnerability was discovered in code16/sharp when rendering content using the SharpShowTextField component. In affected versions, expressions wrapped in & were evaluated by Vue. Thi...

CVE-2025-62798 Sharp user-provided input can be evaluated in a SharpShowTextField with Vue template syntax

Sharp is a content management framework built for Laravel as a package. Prior to 9.11.1, a Cross-Site Scripting XSS vulnerability was discovered in code16/sharp when rendering content using the SharpShowTextField component. In affected versions, expressions wrapped in & were evaluated by Vue. Thi...

CVE-2025-62798 Sharp user-provided input can be evaluated in a SharpShowTextField with Vue template syntax

Sharp is a content management framework built for Laravel as a package. Prior to 9.11.1, a Cross-Site Scripting XSS vulnerability was discovered in code16/sharp when rendering content using the SharpShowTextField component. In affected versions, expressions wrapped in & were evaluated by Vue. Thi...

CVE-2025-62798

The CVE-2025-62798 issue affects the code16/sharp package (Sharp) used with Laravel, specifically the SharpShowTextField component. In vulnerable versions prior to 9.11.1, Vue evaluated expressions wrapped in {{ ... }} when rendering content, allowing attacker-controlled input to execute arbitrar...

EUVD-2025-36547

zhangyd-c OneBlog before 2.3.9 was vulnerable to SSTI Server-Side Template Injection via FreeMarker templates...

CVE-2025-60355

zhangyd-c OneBlog v2.3.9 and before was vulnerable to SSTI Server-Side Template Injection via FreeMarker templates...

CVE-2025-60355

zhangyd-c OneBlog v2.3.9 and before was vulnerable to SSTI Server-Side Template Injection via FreeMarker templates...

OneBlog 安全漏洞

OneBlog is a beautiful and powerful Java blog by yadong.zhang individual developer. A security vulnerability exists in OneBlog versions prior to 2.3.9, which stems from a server-side template injection in FreeMarker templates...

CVE-2025-60355

zhangyd-c OneBlog v2.3.9 and before was vulnerable to SSTI Server-Side Template Injection via FreeMarker templates...

CVE-2025-60355

zhangyd-c OneBlog v2.3.9 and before was vulnerable to SSTI Server-Side Template Injection via FreeMarker templates...

CVE-2025-60355

CVE-2025-60355 affects the web application OneBlog prior to version 2.3.9. The vulnerability is a Server-Side Template Injection (SSTI) via FreeMarker templates, caused by unsafe processing of templates on the server. The CVE entries indicate a high-impact profile (CVSS 3.1: 9.8, CRITICAL) with n...

CVE-2025-60355

zhangyd-c OneBlog v2.3.9 and before was vulnerable to SSTI Server-Side Template Injection via FreeMarker templates...

PT-2025-44194

Name of the Vulnerable Software and Affected Versions zhangyd-c OneBlog versions prior to 2.3.9 Description The software is susceptible to Server-Side Template Injection SSTI through FreeMarker templates. SSTI allows an attacker to inject malicious code into the server, potentially leading to...

Cross-site Scripting

dotnetnuke.core is vulnerable to Cross-site Scripting XSS. The vulnerability is due to improper encoding of user input in URL and template rendering, allowing attackers to inject malicious scripts that execute in victims’ browsers...

CVE-2024-6690

creationtimestamp| type| source ---|---|--- 2025-10-27 01:52:34+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2024/CVE-2024-6690.yaml 2025-10-27 21:02:34+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3m47cvwti532k 2025-12-02...

CVE-2025-12072

The Disable Content Editor For Specific Template plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0. This is due to missing nonce validation on template configuration updates. This makes it possible for unauthenticated attackers to add or...

CVE-2025-11760 eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams <= 1.5.6 - Unauthenticated Sensitive Information Exposure

The eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams plugin for WordPress is vulnerable to exposure of sensitive information in all versions up to, and including, 1.5.6. This is due to the plugin exposing Zoom SDK secret keys in client-side JavaScript within the meeting vie...

CVE-2025-12072

The Disable Content Editor For Specific Template plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0. This is due to missing nonce validation on template configuration updates. This makes it possible for unauthenticated attackers to add or...

CVE-2025-12072 Disable Content Editor For Specific Template <= 2.0 - Cross-Site Request Forgery to Template Configuration Update

The Disable Content Editor For Specific Template plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0. This is due to missing nonce validation on template configuration updates. This makes it possible for unauthenticated attackers to add or...