14883 matches found
The vulnerability of the TemplateHandler component in the \src\main\java\com\cms\controller\admin\TemplateController.java file of the Jfinal CMS content management system allows a hacker to execute arbitrary code.
The vulnerability of the TemplateHandler component in the \src\main\java\com\cms\controller\admin\TemplateController.java file of the Jfinal CMS content management system is related to improper code generation. Exploiting this vulnerability allows a malicious actor to execute arbitrary code...
CVE-2024-57450
ChestnutCMS =1.5.0 is vulnerable to File Upload via the Create template function...
CVE-2024-57450
ChestnutCMS =1.5.0 is vulnerable to File Upload via the Create template function...
Security update for python-Jinja2
This update for python-Jinja2 fixes the following issues: CVE-2024-56201: Fixed sandbox breakout through malicious content and filename of a template bsc1234808 CVE-2024-56326: Fixed sandbox breakout through indirect reference to format method bsc1234809 Patch Instructions: To install this SUSE...
Malicious code in worker-template-postgres (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 06ee62f6404cbc2ab384a294313e49c9685b3f7a3251a4c9b86dd1d8e90dfb05 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-1198 Malicious code in worker-template-postgres (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 06ee62f6404cbc2ab384a294313e49c9685b3f7a3251a4c9b86dd1d8e90dfb05 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in world-id-cloud-template (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d426aafebc49ece5e901783812aae442cd394ad918b10e797b1fc10f9e56d0f2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-1199 Malicious code in world-id-cloud-template (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d426aafebc49ece5e901783812aae442cd394ad918b10e797b1fc10f9e56d0f2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
PT-2025-3447 · Unknown · Chestnutcms
Name of the Vulnerable Software and Affected Versions: ChestnutCMS versions 1.5.0 and earlier Description: The issue allows for File Upload via the Create template function. Recommendations: For ChestnutCMS versions 1.5.0 and earlier, update to a version that fixes this issue. At the moment, ther...
ChestnutCMS 安全漏洞
ChestnutCMS is a front-end and back-end separated enterprise-level content management system by liweiyi individual developer. A security vulnerability exists in ChestnutCMS version 1.5.0 and prior versions, which stems from the vulnerability of uploading files via the Create Template feature...
CVE-2024-57450
ChestnutCMS =1.5.0 is vulnerable to File Upload via the Create template function...
The vulnerability of the graph creation function or graph template creation function of the Cacti network monitoring software allows a hacker to execute arbitrary code.
The vulnerability of the graph creation function or graph template creation function in the Cacti network monitoring software is related to improper handling of line separators. Exploiting this vulnerability allows an attacker who operates remotely to execute arbitrary code...
ASB-A-286235483
In applyCustomDescription of SaveUi.java, there is a possible way to view another user's image content. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2024-8494
The Elementor Website Builder Pro plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.25.10 via the 'elementor-template' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract...
CVE-2024-12102
The Typer Core plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.9.6 via the 'elementor-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level...
CVE-2023-37999
creationtimestamp| type| source ---|---|--- 2025-01-30 02:17:49+00:00| seen| Telegram/mwOGtYpeLb6NwMm3XVbF1OQTZbiCjSFR5gPGLhNsdYvtZL9M 2025-12-01 02:41:35+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2023/CVE-2023-37999.yaml 2025-12-04 21:02:37+00:00|...
USN-7244-1 jinja2 vulnerabilities
It was discovered that Jinja2 incorrectly handled certain filenames when compiling template content. An attacker could possibly use this issue to execute arbitrary code. CVE-2024-56201 It was discovered that Jinja2 incorrectly handled string formatting calls. An attacker could possibly use this...
PT-2025-3701 · WordPress · Elementor Website Builder
Name of the Vulnerable Software and Affected Versions: Elementor Website Builder Pro plugin for WordPress versions prior to 3.25.11 Description: The issue allows authenticated attackers with Contributor-level access and above to extract sensitive data, including the content of Private, Pending, a...
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Overview twig/twig is a flexible, fast, and secure template language for PHP. Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' due to improper handling of the null coalesce operator ??. This is...