CVE-2023-37049

emlog 2.1.9 is vulnerable to Arbitrary file deletion via admin\template.php...

CVE-2023-37049

CVE-2023-37049 affects emlog 2.1.9, where an Arbitrary file deletion vulnerability exists via the admin/template.php endpoint. The connected sources confirm the affected software and the underlying issue (unauthorized deletion of files through a web-accessible admin path). No concrete exploit det...

CVE-2023-37049: Missing Authorization

emlog 2.1.9 is vulnerable to Arbitrary file deletion via admin\template.php...

CVE-2023-30264

CLTPHP =6.0 is vulnerable to Unrestricted Upload of File with Dangerous Type via application/admin/controller/Template.php:update...

Unrestricted file upload

CLTPHP =6.0 is vulnerable to Unrestricted Upload of File with Dangerous Type via application/admin/controller/Template.php:update...

CVE-2023-30264: Unrestricted Upload of File with Dangerous Type

CLTPHP =6.0 is vulnerable to Unrestricted Upload of File with Dangerous Type via application/admin/controller/Template.php:update...

PT-2023-22614

Name of the Vulnerable Software and Affected Versions CLTPHP versions prior to 6.1 Description The issue concerns an unrestricted upload of files with dangerous types. This is possible via the application/admin/controller/Template.php update function. Recommendations For versions prior to 6.1,...

CVE-2023-30269

CLTPHP =6.0 is vulnerable to Improper Input Validation via application/admin/controller/Template.php...

CVE-2023-30269: Improper Input Validation

CLTPHP =6.0 is vulnerable to Improper Input Validation via application/admin/controller/Template.php...

CVE-2023-30269

CLTPHP =6.0 is vulnerable to Improper Input Validation via application/admin/controller/Template.php...

CVE-2023-26265: Improper Limitation of a Pathname to a Restricted Directory

The Borg theme before 1.1.19 for Backdrop CMS does not sufficiently sanitize path arguments that are passed in via a URL. The function borgpreprocesspage in the file template.php does not properly sanitize incoming path arguments before using them...

CVE-2023-0783: Unrestricted Upload of File with Dangerous Type

A vulnerability was found in EcShop 4.1.5. It has been classified as critical. This affects an unknown part of the file /ecshop/admin/template.php of the component PHP File Handler. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been...

Twig remote code execution in templates

The displayBlock function Template.php in Sensio Labs Twig before 1.20.0, when Sandbox mode is enabled, allows remote attackers to execute arbitrary code via the self variable in a template...

Sandbox bypass in fenom

In fenom 2.12.1 and before, there is a way in fenom/src/Fenom/Template.php function getTemplateCodeto bypass sandbox to execute arbitrary PHP code when disablenativefuncs is true...

GHSA-674V-3G2W-84GX Sandbox bypass in fenom

In fenom 2.12.1 and before, there is a way in fenom/src/Fenom/Template.php function getTemplateCodeto bypass sandbox to execute arbitrary PHP code when disablenativefuncs is true...

CVE-2021-46433

In fenom 2.12.1 and before, there is a way in fenom/src/Fenom/Template.php function getTemplateCodeto bypass sandbox to execute arbitrary PHP code when disablenativefuncs is true...

CVE-2021-46433

CVE-2021-46433 concerns Fenom (PHP template engine) up to version 2.12.1 and earlier. The vulnerability lies in fenom/src/Fenom/Template.php, function getTemplateCode(), where a sandbox bypass can occur when disable_native_funcs is true, enabling arbitrary PHP code execution. Public records acros...

CVE-2020-21654

emlog v6.0 contains a vulnerability in the component admin\template.php, which allows attackers to getshell via a crafted Zip file...

CVE-2020-21654

Affected software: emlog v6.0. Vulnerability: A flaw in the admin\template.php component allows an attacker to obtain a shell by crafting a malicious ZIP file. This is linked to improper validation of uploaded ZIPs. Impact: Remote code execution with high severity potential due to arbitrary shell...

CVE-2020-21654: Undefined Security Weakness

emlog v6.0 contains a vulnerability in the component admin\template.php, which allows attackers to getshell via a crafted Zip file...