CVE-2025-50977

Gitblit (version 1.7.1) contains a template injection vulnerability that enables reflected XSS via the r parameter. Exploitation requires authenticated admin access and can be triggered through GET requests to the /summary endpoint or POST requests to certain Wicket interfaces, enabling injection...

Solspace Freeform plugin for Craft CMS 安全漏洞

Solspace Freeform plugin for Craft CMS is an open source plugin from Solspace. A security vulnerability exists in Solspace Freeform plugin for Craft CMS versions prior to 5.0.0 through 5.10.16, which stems from server-side template injection and could lead to arbitrary code execution...

PT-2025-34870 · Craft Cms · Craft Cms +1

Name of the Vulnerable Software and Affected Versions: Freeform versions 5.0.0 through 5.10.16 Description: The Freeform plugin for CraftCMS contains a Server-side template injection SSTI vulnerability. This allows for arbitrary code injection for users with permission to edit a form submission...

Linux Distros Unpatched Vulnerability : CVE-2023-3726

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OCSInventory allow stored email template with special characters that lead to a Stored cross-site Scripting. CVE-2023-3726 Note that Nessus relies on the presen...

Linux Distros Unpatched Vulnerability : CVE-2024-35226

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Smarty is a template engine for PHP, facilitating the separation of presentation HTML/CSS from application logic. In affected versions template authors could...

CVE-2025-35113

Agiloft Release 28 does not properly neutralize special elements used in an EUI template engine, allowing an authenticated attacker to achieve remote code execution by loading a specially crafted payload. Users should upgrade to Agiloft Release 31...

CVE-2025-35112

CVE-2025-35112 describes an XML External Entities path-traversal vulnerability in Agiloft Release 28, exploitable via any table that allows import/export. An authenticated attacker can import a template file and traverse local system files. The issue is caused by improper handling of XML entities...

CVE-2025-35112 Agiloft XML external entity local path traversal

Agiloft Release 28 contains an XML External Entities vulnerability in any table that allows 'import/export', allowing an authenticated attacker to import the template file and perform path traversal on the local system files. Users should upgrade to Agiloft Release 31...

CVE-2025-35113

CVE-2025-35113 affects Agiloft Release 28, where improper neutralization of elements in the EUI template engine enables an authenticated attacker to achieve remote code execution by loading a specially crafted payload. The issue is mitigated by upgrading to Agiloft Release 31 (per Red Hat, NVD/CV...

CVE-2025-35113 Agiloft improper neutralization in EUI template engine

Agiloft Release 28 does not properly neutralize special elements used in an EUI template engine, allowing an authenticated attacker to achieve remote code execution by loading a specially crafted payload. Users should upgrade to Agiloft Release 31...

CVE-2025-35113 Agiloft improper neutralization in EUI template engine

Agiloft Release 28 does not properly neutralize special elements used in an EUI template engine, allowing an authenticated attacker to achieve remote code execution by loading a specially crafted payload. Users should upgrade to Agiloft Release 31...

Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in jinja2-3.1.5-py3-none-any.whl

Summary IBM Watson Discovery Cartridge contains a vulnerable version of jinja2-3.1.5-py3-none-any.whl Vulnerability Details CVEID:CVE-2025-27516 DESCRIPTION: Jinja is an extensible templating engine. Prior to 3.1.6, an oversight in how the Jinja sandboxed environment interacts with the |attr filt...

Linux Distros Unpatched Vulnerability : CVE-2017-14720

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Before version 4.8.2, WordPress allowed a Cross-Site scripting attack in the template list view via a crafted template name. CVE-2017-14720 Note that Nessus...

AbanteCart 安全漏洞

AbanteCart is an open source e-commerce platform by AbanteCart. A security vulnerability exists in AbanteCart version 1.4.2, which stems from a directory traversal in the template parameter in index.php, which could lead to access to sensitive system files...

CVE-2025-50971

Directory traversal vulnerability in AbanteCart version 1.4.2 allows unauthenticated attackers to gain access to sensitive system files via the template parameter to index.php...

Agiloft 安全漏洞

Agiloft is a contract management platform from Agiloft Corporation, USA. A security vulnerability exists in Agiloft Release 28 that stems from improper handling of special elements in the EUI template engine, which could lead to remote code execution...

PT-2025-34807 · Unknown · Abantecart

Name of the Vulnerable Software and Affected Versions: AbanteCart version 1.4.2 Description: A directory traversal issue exists in AbanteCart version 1.4.2 that allows unauthenticated attackers to access sensitive system files. This is achieved by manipulating the template parameter within the...

PT-2025-34814 · Agiloft · Agiloft

Name of the Vulnerable Software and Affected Versions: Agiloft versions prior to 31 Description: Agiloft Release 28 does not properly neutralize special elements used in an EUI template engine, allowing an authenticated attacker to achieve remote code execution by loading a specially crafted...

CVE-2025-50971

CVE-2025-50971 affects AbanteCart v1.4.2, exposing a directory traversal flaw that allows unauthenticated access to sensitive system files via the template parameter in index.php. Impact is a confidentiality breach; there is no indication of integrity/availability compromise in the provided sourc...

PT-2025-34818 · Agiloft · Agiloft

Name of the Vulnerable Software and Affected Versions: Agiloft versions prior to 31 Description: Agiloft Release 28 contains an XML External Entities issue in any table that allows 'import/export'. An authenticated attacker can import a template file and perform path traversal on local system...