CVE-2026-96659

A flaw was found in Foreman. This vulnerability allows an authenticated user with low-level Viewer permissions to cause unauthorized information disclosure by submitting requests to template preview endpoints. By exploiting this issue, the user can access sensitive data, such as host root...

CVE-2026-12423

A flaw was found in Foreman. The Red Hat Satellite /unattended/provision API endpoint is vulnerable to an authentication bypass due to a semantic logic flaw in hostverifier.rb. The application verifies the database state of a provisioning token rather than its actual presence in the incoming HTTP...

CVE-2023-22527

CVE-2023-22527 Este repositorio presenta una prueba de concepto de CVE-2023-22527 CVE-2023-22527 | RCE usando SSTI en Confluence Aviso legal Este código es una prueba de concepto de la vulnerabilidad; no animo a nadie a usarlo en instancias de Confluence que no sean de su propiedad. Esta...

CVE-2026-30952-PoC

CVE-2026-30952: PoC de Path Traversal en LiquidJS Este repositorio contiene una Prueba de Concepto PoC para CVE-2026-30952 , una vulnerabilidad de path traversal de alta severidad descubierta en la librería liquidjs versiones console.logo.slice0,500; !imagehttps://assets.kitploit.com/product...

CVE-2025-41089

CVE-2025-41089: XSS Reflejado en Xibo CMS He descubierto una vulnerabilidad de Cross-Site Scripting XSS Reflejado en Xibo CMS v4.1.2. Este problema se origina por la falta de saneamiento adecuado de la entrada proporcionada por el usuario en el campo 'Configuration Name' de ciertos widgets dentro...

CVE-2023-22527-POC

CVE-2023-22527 &color=brighgreen%3E Descripción Una vulnerabilidad de inyección de plantillas en versiones antiguas de Confluence Data Center y Server permite a un atacante no autenticado lograr RCE en una instancia afectada. Los clientes que utilicen una versión afectada deben tomar medidas...

Trestle SSTI in Jinja2 include tags allows arbitrary code execution (Incomplete fix of CVE-2026-46439)

Reporter: Cavan Loughran, Celvex Group Inc.Summary-------The fix for CVE-2026-46439 3.12.2 / 4.0.3 removed the recursive re-render loop in trestle/core/commands/author/jinja.py rendertemplate, but the custom include tags in trestle/core/jinja/tags.py MDSectionInclude, MDCleanInclude still re-pars...

djust is vulnerable to stored/reflected XSS via javascript: URLs in built-in component template tags

ImpactMany djust built-in component template tags djust.components.templatetags. render a developer/user-supplied URL into an href / action attribute, HTML-escaping it with conditionalescape but never validating the URL scheme. HTML escaping prevents attribute breakout but does not neutralize a...

CVE-2026-29053

This is a rework of the Repo by rootxran for this same CVE - https://github.com/rootxran/CVE-2026-29053 During testing against specific Ghost CMS environments, the original theme payload triggered a Fatal Handlebars Error. The CMS failed to activate the malicious theme because it referenced a...

grav-cve-2024-28116

CVE-2024-28116 — Grav CMS 中的 SSTI 与沙箱绕过 对 CVE-2024-28116 的分析与 Docker 复现。该漏洞是 Grav CMS 1.7.44 及更早版本中的一个服务端模板注入（SSTI）漏洞，可绕过安全沙箱，已在 1.7.45 版本中修复。 报告者：Maurizio Siddu akabe1 CVSS v3.1 评分：8.8（高危） 修复版本：Grav CMS 1.7.45 仓库结构 vulnerable Dockerfile Grav CMS 1.7.44（存在漏洞） apache.conf Apache 配置 patched...

CVE-2024-4040-CrushFTP-server

CVE-2024-4040-CrushFTP-server CrushFTP 是一个专有的多协议、多平台文件传输服务器。 CVE-2024-4040 - 在 CrushFTP 所有 10.7.1 和 11.1.0 之前版本的所有平台中，存在一个服务器端模板注入漏洞，允许未经身份验证的远程攻击者读取 VFS 沙箱之外文件系统中的任意文件，绕过认证获得管理员访问权限，并在服务器上执行远程代码。 受影响版本：CrushFTP 10.7.1 和 11.1.0 之前的版本 用法： python3 exploit.py -u -p 用法示例： python3 exploit.py -u...

CVE-2026-96659

A flaw was found in Foreman. This vulnerability allows an authenticated user with low-level Viewer permissions to cause unauthorized information disclosure by submitting requests to template preview endpoints. By exploiting this issue, the user can access sensitive data, such as host root...

CVE-2026-96659

A flaw in Foreman allows an authenticated user with low-level Viewer permissions to cause unauthorized information disclosure by submitting requests to template preview endpoints. This vulnerability can expose sensitive data, including host root passwords . Additionally, if Safemode protections a...

CVE-2026-96659 Foreman: excessive permissions for viewer role on preview

A flaw was found in Foreman. This vulnerability allows an authenticated user with low-level Viewer permissions to cause unauthorized information disclosure by submitting requests to template preview endpoints. By exploiting this issue, the user can access sensitive data, such as host root...

EUVD-2026-90920

A flaw was found in Foreman. This vulnerability allows an authenticated user with low-level Viewer permissions to cause unauthorized information disclosure by submitting requests to template preview endpoints. By exploiting this issue, the user can access sensitive data, such as host root...

CVE-2026-20217

ZendTo 6.15-8 / ClamAV 精确配置 RCE 与 root 变体重现 本目录是一个独立的、授权实验室内使用的复现捆绑包，用于无账户 ZendTo 到 ClamAV 代码执行链，以及其独立的默认配置 Smarty/root-cron 后续阶段。它包含： 完整的可运行 PoC 依赖闭包； 用于构建 Docker 目标拓扑的脚本与溯源记录； 与经测试的 systemd/socket 生命周期匹配的 Docker Compose 定义； fail-closed（默认拒绝）的镜像、软件包、二进制、配置、CVD、DAC、cron、PHP、 MAC 及文件系统语义检查；以及...

CVE-2024-4879-ServiceNow

CVE-2024-4879-ServiceNow ServiceNow 是一个业务转型平台，可帮助企业管理企业运营的数字工作流程。 CVE-2024-4879 可能允许未经身份验证的用户在 Now 平台中远程执行代码。该漏洞通过串联利用三个问题来访问 ServiceNow 数据：Title Injection、Template Injection Mitigation Bypass 和 Filesystem Filter Bypass。 受影响的版本包括 Vancouver、Washington DC Now 和 Utah 平台版本 用法： python3 exploit.py -i...

CVE-2026-12423

A flaw was found in Foreman. The Red Hat Satellite /unattended/provision API endpoint is vulnerable to an authentication bypass due to a semantic logic flaw in hostverifier.rb. The application verifies the database state of a provisioning token rather than its actual presence in the incoming HTTP...

CVE-2026-5061

CVE-2026-5061 Consul Template 在模板评估期间验证了符号链接的指向位置，但其后的依赖项获取读取的却是原始路径。在这两个操作之间重新定向链接，会将沙箱内的文件引用变成沙箱外的文件泄露。 简介 我在审查 HashiCorp Consul Template 时发现了这个问题，当时我带着一个非常具体的安全疑问： 如果sandboxpath 在模板评估期间验证了符号链接，那么后续的文件读取是否仍然绑定到同一个已验证的目标？ 在这个案例中，答案是否定的。 file...

SSTI-Exploit-Detector

SSTI-Exploit-Detector SSTI Exploit Detector 是一款旨在检测 Web 应用程序中潜在 服务器端模板注入（SSTI） 漏洞的工具。 SSTI-Exploit-Detector Jenderal92 功能 自定义 Payload 文件 ：允许用户添加自己的 payload 来测试各种模板引擎。 默认 Payload ：包含预置的 payload，用于检测 Jinja2、Tornado、Ruby 和 Velocity 等流行模板引擎中的漏洞。 自动扫描 ：自动向目标参数发送 payload，并检查响应以检测漏洞。 使用方法 1. 下载并安装 Pytho...