CVE-2026-116213

Webasyst Framework through 4.4.0 contains an arbitrary file read vulnerability in waArchiveTar::writeItem that creates symlinks from theme archives without validating link targets. Authenticated users with theme management rights can upload themes containing symlinks to wa-config/db.php or...

EUVD-2026-109805

Webasyst Framework through 4.4.0 contains an arbitrary file read vulnerability in waArchiveTar::writeItem that creates symlinks from theme archives without validating link targets. Authenticated users with theme management rights can upload themes containing symlinks to wa-config/db.php or...

CVE-2026-116213 Webasyst Framework through 4.4.0 Arbitrary File Read via waArchiveTar Symlinks

Webasyst Framework through 4.4.0 contains an arbitrary file read vulnerability in waArchiveTar::writeItem that creates symlinks from theme archives without validating link targets. Authenticated users with theme management rights can upload themes containing symlinks to wa-config/db.php or...

CVE-2026-116213 Webasyst Framework through 4.4.0 Arbitrary File Read via waArchiveTar Symlinks

Webasyst Framework through 4.4.0 contains an arbitrary file read vulnerability in waArchiveTar::writeItem that creates symlinks from theme archives without validating link targets. Authenticated users with theme management rights can upload themes containing symlinks to wa-config/db.php or...

PT-2026-123322

Webasyst Framework through 4.4.0 contains an arbitrary file read vulnerability in waArchiveTar::writeItem that creates symlinks from theme archives without validating link targets. Authenticated users with theme management rights can upload themes containing symlinks to wa-config/db.php or...

CVE-2026-100303 TDuck survey form through 6.0 Missing Authorization in Form Theme Management Endpoints

TDuck survey form through 6.0 lacks authorization checks on FormThemeController write endpoints for global form themes and categories. Authenticated non-admin users can add, modify, or delete themes and theme categories affecting forms owned by other users...

Dotnetnuke < 10.3.3 Portal administrator remote code execution (GHSA-hxc3-xv8x-w2g3)

According to its self-reported version, the instance of Dotnetnuke running on the remote web server is prior to 10.3.3. It is, therefore, affected by a vulnerability. - A vulnerability could allow a Portal Administrator to execute arbitrary code on the DNN server under certain deployment...

CVE-2024-39203

A cross-site scripting XSS vulnerability in the Backend Theme Management module of Z-BlogPHP v1.7.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

EUVD-2024-33148

Malicious code in bioql PyPI...

EUVD-2023-49848

Malicious code in bioql PyPI...

EUVD-2021-28866

Malicious code in bioql PyPI...

CVE-2024-10479

A vulnerability, which was classified as problematic, was found in LinZhaoguan pb-cms up to 2.0.1. Affected is an unknown function of the file /adminthemes of the component Theme Management Module. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The...

CVE-2024-28713

An issue in Mblog Blog system v.3.5.0 allows an attacker to execute arbitrary code via a crafted file to the theme management feature...

CVE-2024-51229

Cross Site Scripting vulnerability in LinZhaoguan pb-cms v.2.0 allows a remote attacker to execute arbitrary code via the theme management function...

CVE-2023-45556

Cross Site Scripting vulnerability in Mybb Mybb Forums v.1.8.33 allows a local attacker to execute arbitrary code via the theme Name parameter in the theme management component...

CVE-2024-51229

Cross Site Scripting vulnerability in LinZhaoguan pb-cms v.2.0 allows a remote attacker to execute arbitrary code via the theme management function...

CVE-2024-51229

Cross Site Scripting vulnerability in LinZhaoguan pb-cms v.2.0 allows a remote attacker to execute arbitrary code via the theme management function...

PT-2025-2898 · Linzhaoguan · Linzhaoguan Pb-Cms

Name of the Vulnerable Software and Affected Versions: LinZhaoguan pb-cms version 2.0 Description: The issue allows a remote attacker to execute arbitrary code via the theme management function. This is a result of a Cross Site Scripting vulnerability. Recommendations: For LinZhaoguan pb-cms...

pb-cms security vulnerabilities

pb-cms waterfall content management system is a content management system by LinZhaoguan Personal Developer. A security vulnerability exists in pb-cms version v.2.0. A remote attacker can exploit the vulnerability to execute arbitrary code via the theme management feature...

CVE-2024-51229

Cross Site Scripting vulnerability in LinZhaoguan pb-cms v.2.0 allows a remote attacker to execute arbitrary code via the theme management function...