SUSE CVE-2024-55660

SiYuan is a personal knowledge management system. Prior to version 3.1.16, SiYuan's /api/template/renderSprig endpoint is vulnerable to Server-Side Template Injection SSTI through the Sprig template engine. Although the engine has limitations, it allows attackers to access environment variables...

Craft CMS Twig Template Injection RCE via FTP Templates Path

This module exploits a Twig template injection vulnerability in Craft CMS by abusing the --templatesPath argument. The vulnerability allows arbitrary template loading via FTP, leading to Remote Code Execution RCE. Module Options msf use exploit/linux/http/craftcms/ftptemplate msf...

The vulnerability of the getdocument.vm template in the XWiki platform for creating collaborative web applications allows a perpetrator to gain unauthorized access to read, modify, or delete data.

The vulnerability of the getdocument.vm template in the XWiki platform involves improper coding or encapsulation of output data during the processing of the request.sort parameter. Exploiting this vulnerability allows a malicious actor to gain unauthorized access to read, modify, or delete data b...

Duplicate Advisory: openCart Server-Side Template Injection (SSTI) vulnerability

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-xrh7-2gfq-4rcq. This link is maintained to preserve external references. Original Description OpenCart 4.0.2.3 is vulnerable to Server-Side Template Injection SSTI via the Theme Editor Function...

GHSA-J2V2-3784-VR44 Duplicate Advisory: openCart Server-Side Template Injection (SSTI) vulnerability

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-xrh7-2gfq-4rcq. This link is maintained to preserve external references. Original Description OpenCart 4.0.2.3 is vulnerable to Server-Side Template Injection SSTI via the Theme Editor Function...

Improper Neutralization of Special Elements Used in a Template Engine

Overview opencart/opencart is a shopping cart system Affected versions of this package are vulnerable to Improper Neutralization of Special Elements Used in a Template Engine via the Theme Editor due to improper sanitization. An attacker can manipulate server-side templates and execute arbitrary...

CVE-2024-36694

OpenCart 4.0.2.3 is vulnerable to Server-Side Template Injection SSTI via the Theme Editor Function...

CVE-2024-12340 Animation Addons for Elementor <= 1.1.6 - Authenticated (Contributor+) Sensitive Information Exposure via Content Slider and Tabs Widget Elementor Template

The Animation Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.6 via the 'render' function in widgets/content-slider.php and widgets/tabs.php. This makes it possible for authenticated attackers, with...

CVE-2024-56175

In Optimizely Configured Commerce before 5.2.2408, malicious payloads can be stored and subsequently executed in users' browsers under specific conditions: XSS from client-side template injection in list item names...

CVE-2024-56175

In Optimizely Configured Commerce before 5.2.2408, malicious payloads can be stored and subsequently executed in users' browsers under specific conditions: XSS from client-side template injection in list item names...

CVE-2024-56174

In Optimizely Configured Commerce before 5.2.2408, malicious payloads can be stored and subsequently executed in users' browsers under specific conditions: XSS from client-side template injection in search history...

CVE-2024-56174

In Optimizely Configured Commerce before 5.2.2408, malicious payloads can be stored and subsequently executed in users' browsers under specific conditions: XSS from client-side template injection in search history...

CVE-2024-36694

OpenCart 4.0.2.3 is vulnerable to Server-Side Template Injection SSTI via the Theme Editor Function...

OpenCart 安全漏洞

OpenCart is an open source e-commerce system by the OpenCart team in China. The system provides modules for product reviews, product ratings, and product additions. A security vulnerability exists in OpenCart version 4.0.2.3, which stems from a server-side template injection that can be performed...

CVE-2024-56174

Optimizely Configured Commerce prior to 5.2.2408 is affected by a stored XSS due to client-side template injection in search history. The vulnerability arises from storing malicious payloads that may be executed in users’ browsers under certain conditions. Affected software: Optimizely Configured...

CVE-2024-36694

OpenCart 4.0.2.3 is vulnerable to Server-Side Template Injection SSTI via the Theme Editor Function...

CVE-2024-56174

In Optimizely Configured Commerce before 5.2.2408, malicious payloads can be stored and subsequently executed in users' browsers under specific conditions: XSS from client-side template injection in search history...

CVE-2024-36694

OpenCart 4.0.2.3 is vulnerable to Server-Side Template Injection SSTI via the Theme Editor Function...

CVE-2024-56175

CVE-2024-56175 affects Optimizely Configured Commerce prior to 5.2.2408. The vulnerability arises from a client-side template injection in list item names, enabling stored XSS where malicious payloads can be stored and later executed in users’ browsers under specific conditions. Affected versions...

CVE-2024-56175

In Optimizely Configured Commerce before 5.2.2408, malicious payloads can be stored and subsequently executed in users' browsers under specific conditions: XSS from client-side template injection in list item names...