EUVD-2019-7775

Malware in sbrugna...

EUVD-2020-15802

Malware in sbrugna...

EUVD-2020-10953

Malware in sbrugna...

EUVD-2024-44198

Malicious code in bioql PyPI...

CVE-2020-23046

DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting XSS vulnerabilities in the component tpl.php via the filename, mid, userid, and templet' parameters...

CVE-2025-4545 CTCMS Content Management System File Tpl.php del path traversal

A vulnerability was found in CTCMS Content Management System 2.1.2. It has been classified as critical. Affected is the function del of the file ctcms\apps\controllers\admin\Tpl.php of the component File Handler. The manipulation of the argument File leads to path traversal. It is possible to...

CVE-2024-4587 DedeCMS tpl.php cross-site request forgery

A vulnerability was found in DedeCMS 5.7 and classified as problematic. This issue affects some unknown processing of the file /src/dede/tpl.php. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be use...

CVE-2024-4587: Cross-Site Request Forgery (CSRF)

A vulnerability was found in DedeCMS 5.7 and classified as problematic. This issue affects some unknown processing of the file /src/dede/tpl.php. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be use...

CVE-2023-34842: Improper Control of Generation of Code

Remote Code Execution vulnerability in DedeCMS through 5.7.109 allows remote attackers to run arbitrary code via crafted POST request to /dede/tpl.php...

Dolibarr sensitive information disclosure

Dolibarr ERP/CRM version 6.0.4 does not block direct requests to .tpl.php files, which allows remote attackers to obtain sensitive information...

CVE-2020-23046

DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting XSS vulnerabilities in the component tpl.php via the filename, mid, userid, and templet' parameters...

CVE-2020-23046

DedeCMS v7.5 SP2 contains multiple cross-site scripting (XSS) vulnerabilities in the tpl.php component, exploitable via the filename, mid, userid, and templet parameters. The CVE records indicate an XSS flaw affecting this release without detailing the exploit vector beyond parameter abuse. The c...

CVE-2020-23046: Improper Neutralization of Input During Web Page Generation

DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting XSS vulnerabilities in the component tpl.php via the filename, mid, userid, and templet' parameters...

Cross site scripting

Cross Site Scripting XSS in S-CMS v1.0 allows remote attackers to execute arbitrary code via the component '/admin/tpl.php?page='...

CVE-2020-19046: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS in S-CMS v1.0 allows remote attackers to execute arbitrary code via the component '/admin/tpl.php?page='...

DedeCMS v7.5 SP2 - Multiple Cross Site Web Vulnerabilities

Document Title: =============== DedeCMS v7.5 SP2 - Multiple Cross Site Web Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2194 Release Date: ============= 2020-04-07 Vulnerability Laboratory ID VL-ID: ===================================...

CVE-2019-17368

S-CMS v1.5 has XSS in tpl.php via the member/memberlogin.php from parameter...

CVE-2019-17368

CVE-2019-17368 affects S-CMS v1.5 with a reflected/self-XSS in tpl.php via the parameter in member_login.php. The connected Red Hat/Redirection entries confirm the same description. The available sources do not provide exploitation status, affected versions beyond v1.5, or remediation details. Ro...

CVE-2019-17368: Improper Neutralization of Input During Web Page Generation

S-CMS v1.5 has XSS in tpl.php via the member/memberlogin.php from parameter...

CVE-2018-19127: Improper Control of Generation of Code

A code injection vulnerability in /type.php in PHPCMS 2008 allows attackers to write arbitrary content to a website cache file with a controllable filename, leading to arbitrary code execution. The PHP code is sent via the template parameter, and is written to a data/cachetemplate/.tpl.php file...