CVE-2026-45270: Improper Neutralization of Input During Web Page Generation

CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the Pages backend module registers the htmlpurify validation rule on language-keyed page content but persists the raw, un-purified POST value into the database. The public renderer for pages Home::index ...

CVE-2022-34121

Cuppa CMS v1.0 was discovered to contain a local file inclusion LFI vulnerability via the component /templates/default/html/windows/right.php...

CVE-2022-34121

Cuppa CMS v1.0 was discovered to contain a local file inclusion LFI vulnerability via the component /templates/default/html/windows/right.php...

CVE-2022-27984

CuppaCMS v1.0 was discovered to contain a SQL injection vulnerability via the menufilter parameter at /administrator/templates/default/html/windows/right.php...

CVE-2011-5314: Exposure of Sensitive Information to an Unauthorized Actor

templates/default/index.php in Redaxscript 0.3.2 allows remote attackers to obtain sensitive information via a direct request, which reveals the full path in an error message...

CVE-2014-5451: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in manager/templates/default/header.tpl in MODX Revolution 2.3.1-pl and earlier allows remote attackers to inject arbitrary web script or HTML via the "a" parameter to manager/. NOTE: this issue exists because of a CVE-2014-2080 regression...

CVE-2014-4547: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in templates/default/indexajax.php in the Rezgo Online Booking plugin before 1.8.2 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 tags or 2 searchfor parameter...

CVE-2011-5220: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in templates/default/Admin/Login.html in PHP-SCMS 1.6.8 and earlier allows remote attackers to inject arbitrary web script or HTML via the lang parameter to index.php...

CVE-2008-1043: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in templates/default/header.inc.php in Linux Web Shop LWS php User Base 1.3 BETA allows remote attackers to execute arbitrary PHP code via a URL in the menu parameter...

CVE-2005-1954: Undefined Security Weakness

singapore 0.9.11 allows remote attackers to obtain sensitive information via a direct request to 1 admin.class.php, 2 any .tpl.php file in templates/admindefault/, or 3 any .tpl.php file in templates/default/, which reveal the path in an error message...