CVE-2025-7408

A vulnerability has been found in SourceCodester Zoo Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /admin/templates/animalformtemplate.php. The manipulation of the argument msg leads to cross site scripting. The attack can be initiated...

AZL-65100 CVE-2025-32990 affecting package gnutls for versions less than 3.8.3-6

A heap-buffer-overflow off-by-one flaw was found in the GnuTLS software in the template parsing logic within the certtool utility. When it reads certain settings from a template file, it allows an attacker to cause an out-of-bounds OOB NULL pointer write, resulting in memory corruption and a...

AZL-65091 CVE-2025-32990 affecting package gnutls for versions less than 3.7.11-4

A heap-buffer-overflow off-by-one flaw was found in the GnuTLS software in the template parsing logic within the certtool utility. When it reads certain settings from a template file, it allows an attacker to cause an out-of-bounds OOB NULL pointer write, resulting in memory corruption and a...

DEBIAN-CVE-2025-32990

A heap-buffer-overflow off-by-one flaw was found in the GnuTLS software in the template parsing logic within the certtool utility. When it reads certain settings from a template file, it allows an attacker to cause an out-of-bounds OOB NULL pointer write, resulting in memory corruption and a...

ALPINE-CVE-2025-32990

A heap-buffer-overflow off-by-one flaw was found in the GnuTLS software in the template parsing logic within the certtool utility. When it reads certain settings from a template file, it allows an attacker to cause an out-of-bounds OOB NULL pointer write, resulting in memory corruption and a...

CVE-2025-32990

A heap-buffer-overflow off-by-one flaw was found in the GnuTLS software in the template parsing logic within the certtool utility. When it reads certain settings from a template file, it allows an attacker to cause an out-of-bounds OOB NULL pointer write, resulting in memory corruption and a...

UBUNTU-CVE-2025-32990

A heap-buffer-overflow off-by-one flaw was found in the GnuTLS software in the template parsing logic within the certtool utility. When it reads certain settings from a template file, it allows an attacker to cause an out-of-bounds OOB NULL pointer write, resulting in memory corruption and a...

CVE-2025-32990

A heap-buffer-overflow off-by-one flaw was found in the GnuTLS software in the template parsing logic within the certtool utility. When it reads certain settings from a template file, it allows an attacker to cause an out-of-bounds OOB NULL pointer write, resulting in memory corruption and a...

GnuTLS 安全漏洞

GnuTLS is a free secure communication library for implementing SSL, TLS and DTLS protocols. A security vulnerability exists in GnuTLS that stems from a heap buffer overflow in the certtool tool's template parsing logic, which could lead to memory corruption and denial of service...

PT-2025-29134 · Unknown · Secure-Upload

Name of the Vulnerable Software and Affected Versions: Secure-upload versions prior to 0.815.0 Description: Secure-upload is a data submission service that validates single-use tokens when accepting submissions to channels. The service was installed on a limited number of environments. Privileged...

SourceCodester Zoo Management System 代码注入漏洞

SourceCodester Zoo Management System is a SourceCodester open source zoo management system. A code injection vulnerability exists in SourceCodester Zoo Management System version 1.0, which originates from a cross-site script that can be caused by manipulation of the parameter msg in file...

XWiki Platform SolrSearch Macro Remote Code Execution

XWiki Platform versions from 5.3-milestone-2 before 15.10.11 and from 16.0.0-rc-1 before 16.4.1 suffer from a Server-Side Template Injection SSTI due to the lack of sanitization of the SolrSearch Macro requests. By leveraging this vulnerability, a remote and unauthenticated attacker can achieve...

EulerOS 2.0 SP10 : python-jinja2 (EulerOS-SA-2025-1787)

According to the versions of the python-jinja2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Jinja is an extensible templating engine. Prior to 3.1.6, an oversight in how the Jinja sandboxed environment interacts with the |attr filte...

EulerOS 2.0 SP10 : python-jinja2 (EulerOS-SA-2025-1810)

According to the versions of the python-jinja2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Jinja is an extensible templating engine. Prior to 3.1.6, an oversight in how the Jinja sandboxed environment interacts with the |attr filte...

Heap-based Buffer Overflow

Overview Affected versions of this package are vulnerable to Heap-based Buffer Overflow in the template parsing process within the certtool utility. An attacker can cause memory corruption and potentially crash the system by providing a specially crafted template file that triggers an out-of-boun...

📄 Tiki Wiki CMS Groupware 28.3 Server-Side Template Injection

Tiki Wiki CMS Groupware versions 28.3 and below suffer from two server-side template injection vulnerabilities via specially crafted wiki pages. ---------------------------------------------------------------------------------- Tiki Wiki CMS Groupware '" The second vulnerability can be leveraged ...

SUSE CVE-2025-49136

listmonk is a standalone, self-hosted, newsletter and mailing list manager. Starting in version 4.0.0 and prior to version 5.0.2, the env and expandenv template functions which is enabled by default in Sprig enables capturing of env variables on host. While this may not be a problem on single-use...

Malicious code in workflows-template (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5e1496b26e69a907ccdfa4de45ea382e2c22b156aaa97629f76574f17d12eff2 Any computer that has this package installed or running should be considered...

MAL-2025-5334 Malicious code in workflows-template (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5e1496b26e69a907ccdfa4de45ea382e2c22b156aaa97629f76574f17d12eff2 Any computer that has this package installed or running should be considered...

CVE-2025-49521 Event-driven-ansible: template injection via git branch and refspec in eda projects

A flaw was found in the EDA component of the Ansible Automation Platform, where user-supplied Git branch or refspec values are evaluated as Jinja2 templates. This vulnerability allows authenticated users to inject expressions that execute commands or access sensitive files on the EDA worker. In...