14899 matches found
The vulnerability in the Go programming language’s html/template package allows attackers to execute XSS attacks.
The vulnerability of the Go programming language’s html/template package is related to the lack of measures taken to protect web page structures. Exploiting this vulnerability allows an attacker to perform XSS attacks remotely...
Exploit for CVE-2024-47176
PoC: Unauthenticated RCE on cups-browsed...
CVE-2024-45186
FileSender before 2.49 allows server-side template injection SSTI for retrieving credentials...
FileSender 安全漏洞
FileSender is an open source web application from FileSender that allows authenticated users to securely and easily send arbitrarily large files to other users. A security vulnerability exists in FileSender versions prior to 2.49, which stems from the presence of server-side template injection th...
CVE-2024-47526 LibreNMS has a Self-XSS ('Cross-site Scripting') in librenms/includes/html/modal/alert_template.inc.php
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Self Cross-Site Scripting Self-XSS vulnerability in the "Alert Templates" feature allows users to inject arbitrary JavaScript into the alert template's name. This script executes immediately upon submission but does not...
ROS-20241001-02
Vulnerability of html/template package of Golang programming language is related to incorrect handling of <script> occurrences of <script>, <!--> and </script> in JS literals in <script> contexts. Exploitation vulnerability could allow an attacker acting remotely to perform an...
LibreNMS 跨站脚本漏洞
LibreNMS is an open source network monitoring system based on PHP and MySQL from the LibreNMS community. The system features customizable alerts, auto-discovery of network environments, and automatic updates. A cross-site scripting vulnerability exists in LibreNMS version 24.7.0 and prior version...
October 1, 2024, update for Project 2016 (KB5002638)
None None...
K000141253: Python vulnerability CVE-2024-22195
Security Advisory Description Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting XSS. The Jinja...
Exploit for Code Injection in Crushftp
EN GenCrushSSTIExploit is a PoC exploit tool targeting the...
WordPress Enter Addons – Ultimate Template Builder for Elementor plugin <= 2.1.8 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by João Pedro Soares de Alcântara Kinorth in WordPress Plugin Enter Addons versions = 2.1.8...
CVE-2024-46475
A reflected cross-site scripting XSS vulnerability on the homepage of Metronic Admin Dashboard Template v2.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload...
openSUSE 15 Security Update : coredns (openSUSE-SU-2024:0319-1)
The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2024:0319-1 advisory. Update to version 1.11.3: optimize the performance for high qps 6767 bump deps Fix zone parser error handling 6680 Add alternate option to forwar...
Malicious code in apollo-client-error-template (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis fe552e4b70220e1bb21d16486e988a993baf13fe78babd1d269cea3a7a765954 The OpenSSF Package Analysis project identified 'apollo-client-error-template' @ 2.0.0 npm as malicious. It is considered malicious because: - T...
CVE-2024-46366
A Client-side Template Injection CSTI vulnerability in Webkul Krayin CRM 1.3.0 allows remote attackers to execute arbitrary client-side template code by injecting a malicious payload during the lead creation process. This can lead to privilege escalation when the payload is executed, granting the...
CVE-2024-3373
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in RSM Design Website Template allows SQL Injection. This issue affects Website Template: before 1.2...
CVE-2024-3373
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in RSM Design Website Template allows SQL Injection. This issue affects Website Template: before 1.2...
CVE-2024-3373 SQLi in RSM Design's Website Template
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in RSM Design Website Template allows SQL Injection. This issue affects Website Template: before 1.2...
CVE-2024-3373 SQLi in RSM Design's Website Template
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in RSM Design Website Template allows SQL Injection. This issue affects Website Template: before 1.2...
CVE-2024-3373
CVE-2024-3373 affects RSM Design Website Template prior to version 1.2. The issue is an SQL Injection caused by improper neutralization of special elements in SQL commands, leading to potential unauthorized data access or modification as described across multiple sources. Exploitation details are...