CVE-2012-4901

Template CMS (version 2.1.1 and earlier) is affected by a Cross‑Site Scripting (CWE-79) vulnerability in the themes_editor parameter passed to admin/index.php during add_template, enabling remote injection of arbitrary HTML/JS. Public advisories (HTB23115) describe the issue and note CSRF concern...

CVE-2012-4902

CVE-2012-4902 concerns Template CMS 2.1.1 and earlier. The vulnerability is a CSRF flaw that lets an attacker trick an authenticated administrator into performing unauthorized actions, including adding a new administrator account and potentially triggering code execution through the admin interfa...