WordPress Theme File Duplicator Plugin <= 1.3 - Arbitrary File Download vulnerability

Arbitrary File Download vulnerability discovered by LVT-tholv2k in WordPress Plugin Theme File Duplicator versions = 1.3...

SDCMS 安全漏洞

SDCMS is a PHP and MySQL based enterprise website content management system CMS from China Vivid Network SDCMS. A security vulnerability exists in SDCMS version 2.8, which originates from the theme.php file containing a command execution vulnerability...

PT-2024-34417 · Sdcms · Sdcms

Name of the Vulnerable Software and Affected Versions: SDCMS version 2.8 Description: The theme.php file in SDCMS has a command execution vulnerability that allows for the execution of system commands. Recommendations: For SDCMS version 2.8, consider disabling the theme.php file or restricting it...

Path traversal

A vulnerability, which was classified as problematic, was found in KDE Plasma Workspace up to 5.93.0. This affects the function EventPluginsManager::enabledPlugins of the file components/calendar/eventpluginsmanager.cpp of the component Theme File Handler. The manipulation of the argument pluginI...

CVE-2024-1433

A vulnerability, which was classified as problematic, was found in KDE Plasma Workspace up to 5.93.0. This affects the function EventPluginsManager::enabledPlugins of the file components/calendar/eventpluginsmanager.cpp of the component Theme File Handler. The manipulation of the argument pluginI...

CVE-2024-1433

A vulnerability, which was classified as problematic, was found in KDE Plasma Workspace up to 5.93.0. This affects the function EventPluginsManager::enabledPlugins of the file components/calendar/eventpluginsmanager.cpp of the component Theme File Handler. The manipulation of the argument pluginI...

CVE-2024-1433 KDE Plasma Workspace Theme File eventpluginsmanager.cpp enabledPlugins path traversal

A vulnerability, which was classified as problematic, was found in KDE Plasma Workspace up to 5.93.0. This affects the function EventPluginsManager::enabledPlugins of the file components/calendar/eventpluginsmanager.cpp of the component Theme File Handler. The manipulation of the argument pluginI...

CVE-2024-1433 KDE Plasma Workspace Theme File eventpluginsmanager.cpp enabledPlugins path traversal

A vulnerability, which was classified as problematic, was found in KDE Plasma Workspace up to 5.93.0. This affects the function EventPluginsManager::enabledPlugins of the file components/calendar/eventpluginsmanager.cpp of the component Theme File Handler. The manipulation of the argument pluginI...

PT-2024-18043 · Kde · Kde Plasma Workspace

Name of the Vulnerable Software and Affected Versions: KDE Plasma Workspace versions up to 5.93.0 Description: A problematic vulnerability was found in KDE Plasma Workspace, affecting the function EventPluginsManager::enabledPlugins of the file components/calendar/eventpluginsmanager.cpp of the...

CVE-2024-1433: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability, which was classified as problematic, was found in KDE Plasma Workspace up to 5.93.0. This affects the function EventPluginsManager::enabledPlugins of the file components/calendar/eventpluginsmanager.cpp of the component Theme File Handler. The manipulation of the argument pluginI...

typecho 跨站脚本漏洞

typecho is a PHP blogging platform for typecho personal developers that is simple and powerful. typecho 1.2.1 version of a cross-site scripting vulnerability, the vulnerability stems from the file /admin/options-theme.php on the lack of effective user-supplied data filtering and escaping, an...

Pluck 代码问题漏洞

Pluck is a content management system CMS developed using the PHP language. A security vulnerability exists in Pluck CMS version 4.7.10-dev2. An attacker can exploit this vulnerability to execute arbitrary code and access sensitive information via the theme.php file...

Ghost Directory Traversal Vulnerability

Ghost is an open source content management system . Ghost suffers from a directory traversal vulnerability that stems from a lack of validity checking of paths in frontend/web/middleware/static-theme.js when processing directory requests, which can be exploited by an attacker to read arbitrary...

CVE-2022-41477

A security issue was discovered in WeBid =1.2.2. A Server-Side Request Forgery SSRF vulnerability in the admin/theme.php file allows remote attackers to inject payloads via theme parameters to read files across directories...

CVE-2020-21523

A Server-Side Freemarker template injection vulnerability in halo CMS v1.1.3 In the Edit Theme File function. The ftl file can be edited. This is the Freemarker template file. This file can cause arbitrary code execution when it is rendered in the background. exp: $test"touch /tmp/freemarkerPwned...

CVE-2020-21523

A Server-Side Freemarker template injection vulnerability in halo CMS v1.1.3 In the Edit Theme File function. The ftl file can be edited. This is the Freemarker template file. This file can cause arbitrary code execution when it is rendered in the background. exp: $test"touch /tmp/freemarkerPwned...

CVE-2020-21523: Improper Neutralization of Special Elements in Output Used by a Downstream Component

A Server-Side Freemarker template injection vulnerability in halo CMS v1.1.3 In the Edit Theme File function. The ftl file can be edited. This is the Freemarker template file. This file can cause arbitrary code execution when it is rendered in the background. exp: $test"touch /tmp/freemarkerPwned...

PT-2020-15365

Name of the Vulnerable Software and Affected Versions halo CMS version 1.1.3 Description A Server-Side Freemarker template injection issue exists in the Edit Theme File function, where the ftl file can be edited. This Freemarker template file can cause arbitrary code execution when rendered in th...

CVE-2019-1010124

WebAppick WooCommerce Product Feed 2.2.18 and earlier is affected by: Cross Site Scripting XSS. The impact is: XSS to RCE via editing theme files in WordPress. The component is: admin/partials/woo-feed-manage-list.php:63. The attack vector is: Administrator must be logged in...

Code execution vulnerability in Axublog ad/theme.php file

Axublog is a PHP personal blog system. A code execution vulnerability exists in the Axublog ad/theme.php file. The vulnerability is due to the program failing to filter the parameters passed, an attacker can exploit the vulnerability to construct a specially crafted file, upload a shell, and obta...