CVE-2024-50658

Server-Side Template Injection SSTI was found in AdPortal 3.0.39 allows a remote attacker to execute arbitrary code via the shippingAsBilling and firstname parameters in updateuserinfo.html file...

CVE-2024-50658

Server-Side Template Injection SSTI was found in AdPortal 3.0.39 allows a remote attacker to execute arbitrary code via the shippingAsBilling and firstname parameters in updateuserinfo.html file...

WordPress Jupiter X Core plugin <= 4.8.5 - Missing Authorization to Unauthenticated Popup Template Export vulnerability

Missing Authorization to Unauthenticated Popup Template Export vulnerability discovered by Tieu Pham Trong Nhan in WordPress Plugin JupiterX Core versions = 4.8.5...

CVE-2024-12316 Jupiter X Core <= 4.8.5 - Missing Authorization to Unauthenticated Popup Template Export

The Jupiter X Core plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the exportpopupaction function in all versions up to, and including, 4.8.5. This makes it possible for unauthenticated attackers to export popup templates...

CVE-2024-12316 Jupiter X Core <= 4.8.5 - Missing Authorization to Unauthenticated Popup Template Export

The Jupiter X Core plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the exportpopupaction function in all versions up to, and including, 4.8.5. This makes it possible for unauthenticated attackers to export popup templates...

CVE-2024-12140

The Elementor Addons AI Addons – 70 Widgets, Premium Templates, Ultimate Elements plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.2.1 via the render function due to insufficient restrictions on which templates can be included. This makes it...

CVE-2024-50658

Server-Side Template Injection SSTI was found in AdPortal 3.0.39 allows a remote attacker to execute arbitrary code via the shippingAsBilling and firstname parameters in updateuserinfo.html file...

CVE-2024-50658

Server-Side Template Injection SSTI was found in AdPortal 3.0.39 allows a remote attacker to execute arbitrary code via the shippingAsBilling and firstname parameters in updateuserinfo.html file...

ClipBucket 安全漏洞

ClipBucket is an open source and freely downloadable PHP script from MacWarrior Open Source. It is used for sharing video sites. A security vulnerability exists in ClipBucket V5 5.5.1 - 237 and prior versions that originated from a denial of service that allows an unauthenticated attacker to chan...

CVE-2024-50658

AdPortal 3.0.39 is affected by a Server-Side Template Injection (SSTI) vulnerability that allows a remote attacker to execute arbitrary code via the shippingAsBilling and firstname parameters in updateuserinfo.html. The issue is verified across multiple sources (NVD, Red Hat, CNNVD, CVE lists, an...

iPublish AdPortal 代码注入漏洞

iPublish AdPortal is a self-service newspaper advertising platform from iPublish, Inc. A security vulnerability exists in iPublish AdPortal version 3.0.39 that stems from the presence of server-side template injection SSTI, which allows remote attackers to execute arbitrary code via the...

PT-2025-4307 · Unknown · Clipbucket

Name of the Vulnerable Software and Affected Versions: ClipBucket V5 versions prior to 5.5.1 - 238 Description: The issue allows unauthenticated attackers to change the template directory via a directory traversal, resulting in a denial of service. ClipBucket V5 provides open source video hosting...

PT-2025-2878 · Adportal · Adportal

Name of the Vulnerable Software and Affected Versions: AdPortal version 3.0.39 Description: A Server-Side Template Injection SSTI issue was found, allowing a remote attacker to execute arbitrary code via the shippingAsBilling and firstname parameters in the updateuserinfo.html file...

Security update for python-Jinja2

This update for python-Jinja2 fixes the following issues: CVE-2024-56326: sandbox breakout through indirect reference to format method in template file. bsc1234809 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch...

Z-BlogPHP 安全漏洞

Z-BlogPHP is an open source PHP-based blogging system for the Z-Blog community. A security vulnerability exists in Z-BlogPHP version 1.7.3, which stems from vulnerability to arbitrary code attack via zbusers hemeshell emplate execution...

CVE-2024-55529

CVE-2024-55529 affects Z-BlogPHP 1.7.3, with arbitrary code execution via the path zb_users\theme\shell\template. The issue is evidenced across multiple feeds (NVD/Red Hat/CNNVD/CVE.org), describing unauthenticated remote code execution (CVSS v3.1 score 9.8, vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:...

PT-2025-3126 · Z Blogphp · Z-Blogphp

Name of the Vulnerable Software and Affected Versions: Z-BlogPHP version 1.7.3 Description: The issue allows for arbitrary code execution through the zb usersthemeshelltemplate. This enables an attacker to execute malicious code on the affected system. Recommendations: For Z-BlogPHP version 1.7.3...

CVE-2024-55529

Z-BlogPHP 1.7.3 is vulnerable to arbitrary code execution via \zbusers\theme\shell\template...

CVE-2024-55529

Z-BlogPHP 1.7.3 is vulnerable to arbitrary code execution via \zbusers\theme\shell\template...

CVE-2024-55529

Z-BlogPHP 1.7.3 is vulnerable to arbitrary code execution via \zbusers\theme\shell\template...