CVE-2019-5418

CVE-2019-5418 1. Vulnerability Description Ruby on Rails is a web application framework, a relatively newer web application framework built on the Ruby language. This vulnerability is mainly caused by Ruby on Rails using the render file method with a specified parameter to render views outside th...

CVE-2026-23498

CVE-2026-23498: Shopware Has Improper Control of Generation of Code in Twig rendered views Overview...

PoC_CVE-2016-2098_Rails42

A PoC of CVE-2016-2098 rails 4.2.5.1 view has a vulnerable code app/views/poc/render1.html.erb following command will cause remote code execution $ curl ':3000/poc/render1?template\inline='...

CVE-2026-47884

Spring Framework 's XsltView in Spring MVC is vulnerable to SSRF and RCE when an application uses a /** mapping that triggers view rendering without explicitly specifying the view name. This improper path limitation allows an attacker to manipulate view resolution to execute arbitrary code or mak...

CVE-2026-47884 Spring Framework Improper Path Limitation in XsltView

Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/" mapping that results in view rendering, and where the view name is not explicitly specified. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28...

GO-2026-5957 SiYuan: Stored XSS to RCE via attribute-view cell rendering in genAVValueHTML() in github.com/siyuan-note/siyuan/kernel

SiYuan: Stored XSS to RCE via attribute-view cell rendering in genAVValueHTML in github.com/siyuan-note/siyuan/kernel...

WWBN AVideo 安全漏洞

WWBN AVideo is a video platform building system written in PHP, developed by the WWBN team. Versions of WWBN AVideo prior to version 29 contain security vulnerabilities. These vulnerabilities stem from storing user-input category descriptions as raw HTML during Gallery view rendering. This allows...

EUVD-2026-31190

Yii 2 is a PHP application framework. Versions 2.0.54 and prior contain flawed logic in the core view rendering method View::renderPhpFile that leads to Local File Inclusion. The function calls extract$params, EXTROVERWRITE before the require statement that loads the view file. As a result, a...

CVE-2026-39850

Yii 2 is a PHP application framework. Versions 2.0.54 and prior contain flawed logic in the core view rendering method View::renderPhpFile that leads to Local File Inclusion. The function calls extract$params, EXTROVERWRITE before the require statement that loads the view file. As a result, a...

Yii 2: Local file inclusion via view parameter name collision

The core view rendering method View::renderPhpFile calls extract$params, EXTROVERWRITE before the require statement that includes the view file. A caller-controlled parameter named file in the $params array overwrites the internal local variable that specifies which file is included — enabling a...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the translation helpers translate, t, etc in Action Controller. An attacker can inject malicious scripts by using a key ending in html with a :default key that contains untrusted user input, if the resulting...

A Bootiful Podcast: Spring team legend Dr. David Syer on view rendering technologies, the latest-and-greatest, SpringOne 2023, and more

Hi, Spring fans! In this installment Josh Long talks to the legendary Dr. David Syer about view rendering technologies, SpringOne, and more. Have you registered for SpringOne yet? Are you interested in learning Spring? Check out Spring Academy...