GHSA-44WR-RMWQ-3PHW Craft CMS vulnerable to Remote Code Execution via validatePath bypass

Summary Bypassing the validatePath function can lead to potential Remote Code Execution Post-authentication, ALLOWADMINCHANGES=true Details In bootstrap.php, the SystemPaths path is set as below. php // Set the vendor path. By default assume that it's 4 levels up from here $vendorPath =...

CVE-2023-4450

A vulnerability was found in jeecgboot JimuReport up to 1.6.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Template Handler. The manipulation leads to injection. The attack can be launched remotely. The exploit has been disclosed t...

Design/Logic Flaw

A vulnerability was found in jeecgboot JimuReport up to 1.6.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Template Handler. The manipulation leads to injection. The attack can be launched remotely. The exploit has been disclosed t...

CVE-2023-4450 jeecgboot JimuReport Template injection

A vulnerability was found in jeecgboot JimuReport up to 1.6.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Template Handler. The manipulation leads to injection. The attack can be launched remotely. The exploit has been disclosed t...

CVE-2023-4450 jeecgboot JimuReport Template injection

A vulnerability was found in jeecgboot JimuReport up to 1.6.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Template Handler. The manipulation leads to injection. The attack can be launched remotely. The exploit has been disclosed t...

CVE-2023-4450 jeecgboot JimuReport Template injection

A vulnerability was found in jeecgboot JimuReport up to 1.6.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Template Handler. The manipulation leads to injection. The attack can be launched remotely. The exploit has been disclosed t...

CVE-2023-4446

A vulnerability, which was classified as critical, was found in OpenRapid RapidCMS 1.3.1. This affects an unknown part of the file template/default/category.php. The manipulation of the argument id leads to sql injection. The exploit has been disclosed to the public and may be used. The associate...

Sql injection

A vulnerability, which was classified as critical, was found in OpenRapid RapidCMS 1.3.1. This affects an unknown part of the file template/default/category.php. The manipulation of the argument id leads to sql injection. The exploit has been disclosed to the public and may be used. The associate...

CVE-2023-4446 OpenRapid RapidCMS category.php sql injection

A vulnerability, which was classified as critical, was found in OpenRapid RapidCMS 1.3.1. This affects an unknown part of the file template/default/category.php. The manipulation of the argument id leads to sql injection. The exploit has been disclosed to the public and may be used. The associate...

PT-2023-29265 · Unknown · Jeecgboot Jimureport

Name of the Vulnerable Software and Affected Versions: jeecgboot JimuReport versions up to 1.6.0 Description: A critical issue was found in the Template Handler component, allowing for remote injection attacks. The exploit has been disclosed publicly. Recommendations: For jeecgboot JimuReport...

PT-2023-9457 · Unknown +10 · Html/Template +10

Name of the Vulnerable Software and Affected Versions: html/template package affected versions not specified Description: The issue is related to the html/template package not applying proper rules for handling occurrences of " contexts. This may cause the template parser to improperly consider...

PT-2023-29244 · Openrapid · Openrapid Rapidcms

Name of the Vulnerable Software and Affected Versions: OpenRapid RapidCMS version 1.3.1 Description: A critical issue was found in OpenRapid RapidCMS, affecting the file template/default/category.php. The manipulation of the id argument leads to SQL injection. Recommendations: For OpenRapid...

PT-2023-9456 · Google +10 · Go +10

Name of the Vulnerable Software and Affected Versions: Go versions prior to 1.20.8 dev-go/go-tools versions prior to 0.3.0 Description: The issue is related to the html/template package in the Go programming language, which does not properly handle HTML-like comment tokens or hashbang "!" comment...

CVE-2023-31072

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Praveen Goswami Advanced Category Template plugin = 0.1 versions...

CVE-2023-31072

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Praveen Goswami Advanced Category Template plugin = 0.1 versions...

Cross site scripting

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Praveen Goswami Advanced Category Template plugin = 0.1 versions...

CVE-2023-31072 WordPress Advanced Category Template Plugin <= 0.1 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Praveen Goswami Advanced Category Template plugin = 0.1 versions...

CVE-2023-31072

CVE-2023-31072 : Unauthenticated Reflected XSS in the WordPress plugin Advanced Category Template (praveen goswami) ≤ 0.1. Root cause: inputs are not properly sanitised/escaped before output. Impact: potential script execution in admin-facing contexts; exploit requires no authentication but user ...

CVE-2023-40281

EC-CUBE 2.11.0 to 2.17.2-p1 contain a cross-site scripting vulnerability in "mail/template" and "products/product" of Management page. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the other administrator or the user who accessed the website using t...

EC-CUBE 2 series vulnerable to cross-site scripting

Overview EC-CUBE 2 series provided by EC-CUBE CO.,LTD. contains a cross-site scripting vulnerability CWE-79 in "mail/template" and "products/product" of Management page. Shimamine Taihei of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to EC-CUBE CO.,LTD. and EC-CUBE CO.,LTD...