CVE-2023-6745

CVE-2023-6745 concerns the WordPress plugin Custom Field Template . The vulnerability is a Stored Cross-Site Scripting (XSS) via the plugin’s cpt shortcode in all versions up to 2.6.1, caused by insufficient input sanitization and output escaping on user-supplied post meta. Exploitation requires ...

WordPress plugin Custom Field Template security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress plugin Custom Field Template security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

Adfinis Document Merge Service Security Vulnerability

Adfinis Document Merge Service is a merged document template service from Adfinis. A security vulnerability exists in Adfinis Document Merge Service versions 6.5.1 and earlier, which stems from a remote code execution attack that allows an attacker to conduct a remote code execution attack via...

PT-2024-27459

Name of the Vulnerable Software and Affected Versions Document Merge Service versions 6.5.1 and prior Description The issue allows for remote code execution via server-side template injection, which can result in full takeover of the affected system when executed as root. This gives an attacker...

WordPress plugin Custom Field Template security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2024-37166

ghtml is software that uses tagged templates for template engine functionality. It is possible to introduce user-controlled JavaScript code and trigger a Cross-Site Scripting XSS vulnerability in some cases. Version 2.0.0 introduces changes to mitigate this issue. Version 2.0.0 contains updated...

ghtml Cross-Site Scripting (XSS) vulnerability

Summary It is possible to introduce user-controlled JavaScript code and trigger a Cross-Site Scripting XSS vulnerability in some cases. Actions Taken - Updated the documentation to clarify that while ghtml escapes characters with special meaning in HTML, it does not provide comprehensive protecti...

GHSA-VVHJ-V88F-5GXR ghtml Cross-Site Scripting (XSS) vulnerability

Summary It is possible to introduce user-controlled JavaScript code and trigger a Cross-Site Scripting XSS vulnerability in some cases. Actions Taken - Updated the documentation to clarify that while ghtml escapes characters with special meaning in HTML, it does not provide comprehensive protecti...

CVE-2024-37166 ghtml Cross-Site Scripting (XSS) vulnerability

ghtml is software that uses tagged templates for template engine functionality. It is possible to introduce user-controlled JavaScript code and trigger a Cross-Site Scripting XSS vulnerability in some cases. Version 2.0.0 introduces changes to mitigate this issue. Version 2.0.0 contains updated...

CVE-2024-37166 ghtml Cross-Site Scripting (XSS) vulnerability

ghtml is software that uses tagged templates for template engine functionality. It is possible to introduce user-controlled JavaScript code and trigger a Cross-Site Scripting XSS vulnerability in some cases. Version 2.0.0 introduces changes to mitigate this issue. Version 2.0.0 contains updated...

CVE-2024-37166

CVE-2024-37166 affects the ghtml template engine. It enables user-controlled JavaScript execution in some render paths, i.e., an XSS risk. Version 2.0.0 adds mitigations by escaping HTML-special characters and the backtick, but the advisory states this does not provide comprehensive XSS protectio...

CVE-2024-31611

SeaCMS 12.9 has a file deletion vulnerability via admintemplate.php...

WordPress Custom Field Template plugin <= 2.6.1 - Authenticated Stored Cross-Site Scripting vulnerability

Authenticated Stored Cross-Site Scripting vulnerability discovered by Luk 6785 in WordPress Plugin Custom Field Template versions = 2.6.1...

WordPress Custom Field Template plugin <= 2.6.1 - Authenticated Information Exposure vulnerability

Authenticated Information Exposure vulnerability discovered by Francesco Carlucci in WordPress Plugin Custom Field Template versions = 2.6.1...

WordPress Custom Field Template plugin <= 2.6.1 - Authenticated Stored Cross-Site Scripting vulnerability

Authenticated Stored Cross-Site Scripting vulnerability discovered by Francesco Carlucci in WordPress Plugin Custom Field Template versions = 2.6.1...

WordPress Custom Field Template plugin <= 2.6.1 - Authenticated Stored Cross-Site Scripting vulnerability

Authenticated Stored Cross-Site Scripting vulnerability discovered by Sh in WordPress Plugin Custom Field Template versions = 2.6.1...

CVE-2024-31611

SeaCMS 12.9 has a file deletion vulnerability via admintemplate.php...

PT-2024-24152 · Seacms · Seacms

Name of the Vulnerable Software and Affected Versions: SeaCMS version 12.9 Description: The issue is related to a file deletion vulnerability. It can be exploited via the admin template.php file. Recommendations: For SeaCMS version 12.9, consider restricting access to the admin template.php file...

Custom Field Template < 2.6.2 - Authenticated (Admin+) Stored Cross-Site Scritping

Description The Custom Field Template plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...