XMB Forum 跨站脚本漏洞

XMB Forum is an open source forum system by XMB. A cross-site scripting vulnerability exists in XMB Forum version 1.9.12.06, which stems from persistent cross-site scripting in the template and homepage settings, which could lead to script execution by all forum users...

PT-2025-50746

Name of the Vulnerable Software and Affected Versions XMB Forum version 1.9.12.06 Description The software contains a persistent cross-site scripting issue. Authenticated administrators can inject malicious JavaScript into templates and front page settings. Attackers can insert XSS payloads in...

Pretty Mail by FriendsOfFlarum 安全漏洞

Pretty Mail by FriendsOfFlarum is an open source tool from Friends of Flarum that allows you to make custom html templates for emails. A security vulnerability exists in Pretty Mail by FriendsOfFlarum version 1.1.2, which stems from a server-side template injection in an email template that could...

PT-2025-50756

Name of the Vulnerable Software and Affected Versions FoF Pretty Mail version 1.1.2 Description The software contains a server-side template injection issue that allows administrative users to inject malicious code into email templates. An attacker can execute system commands by inserting crafted...

EUVD-2025-202628

A template injection vulnerability in the /vip/v1/file/save component of ChanCMS v3.3.4 allows attackers to execute arbitrary code via a crafted POST request...

CVE-2025-65602

A template injection vulnerability in the /vip/v1/file/save component of ChanCMS v3.3.4 allows attackers to execute arbitrary code via a crafted POST request...

CVE-2025-65602

A template injection vulnerability in the /vip/v1/file/save component of ChanCMS v3.3.4 allows attackers to execute arbitrary code via a crafted POST request...

Important: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update

An update is now available for Red Hat Ansible Automation Platform 2.6 Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

CVE-2025-63058

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Hiroaki Miyashita Custom Field Template custom-field-template allows Retrieve Embedded Sensitive Data.This issue affects Custom Field Template: from n/a through = 2.7.6...

Exploit for Improper Access Control in Shirt-Pocket Superduper\!

CVE-2025-61229 Description From the developer's blog:...

CVE-2025-13339

The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.7.1 via the templateredirect function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain...

CVE-2025-65602

ChanCMS v3.3.4 contains a template injection vulnerability in the /vip/v1/file/save API endpoint that enables arbitrary code execution via a crafted POST request. Affected component/file: /vip/v1/file/save in ChanCMS 3.3.4. Root cause: template injection allowing code execution, as described acro...

ChanCMS 安全漏洞

ChanCMS is a content management system by yanyutao0402 individual developer in China. A security vulnerability exists in ChanCMS version 3.3.4, which originates from a template injection in the /vip/v1/file/save component, which may result in the execution of arbitrary code...

CVE-2025-65602

A template injection vulnerability in the /vip/v1/file/save component of ChanCMS v3.3.4 allows attackers to execute arbitrary code via a crafted POST request...

CVE-2025-65602

A template injection vulnerability in the /vip/v1/file/save component of ChanCMS v3.3.4 allows attackers to execute arbitrary code via a crafted POST request...

PT-2025-50489

Name of the Vulnerable Software and Affected Versions ChanCMS version 3.3.4 Description A template injection issue exists in the /vip/v1/file/save component. Attackers can execute arbitrary code by submitting a specially crafted POST request. The vulnerable component is the /vip/v1/file/save API...

CVE-2025-65271

Client-side template injection CSTI in Azuriom CMS admin dashboard allows a low-privilege user to execute arbitrary template code in the context of an administrator's session. This can occur via plugins or dashboard components that render untrusted user input, potentially enabling privilege...

EUVD-2025-201971

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Hiroaki Miyashita Custom Field Template custom-field-template allows Retrieve Embedded Sensitive Data.This issue affects Custom Field Template: from n/a through = 2.7.4...

CVE-2025-63058

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Hiroaki Miyashita Custom Field Template custom-field-template allows Retrieve Embedded Sensitive Data.This issue affects Custom Field Template: from n/a through = 2.7.6...

CVE-2025-63058 WordPress Custom Field Template plugin <= 2.7.6 - Sensitive Data Exposure vulnerability

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Hiroaki Miyashita Custom Field Template custom-field-template allows Retrieve Embedded Sensitive Data.This issue affects Custom Field Template: from n/a through = 2.7.6...