CVE-2026-77578

CVE-2026-77578 — Xibo CMS Arbitrary Local File Read Overview CVE-2026-77578 is an authenticated Arbitrary Local File Read vulnerability in Xibo CMS. An authenticated user with Admin privileges or Module Templates access can import a crafted XML template containing a path-based asset with a...

thymeleaf-check

thymeleaf-check ThymeleafCVE-2026-40477 / CVE-2026-41901 offline triage tool — zero dependencies, single jar, no network. Two CVSS 9.0 SSTI bypasses, with two fixed releases shipped within nine days. It first answers "which of these am I affected by," then answers the harder question: On my versi...

CVE-2026-18963

Keycloak Reset Path Finder Nuclei template to discover exposed Keycloak reset-credentials endpoints across multiple proxy prefixes, context paths, realm names, and path variations. Summary This template helps identify reachable password reset flows that may be relevant during validation of...

cve-2026-4257

CVE-2026-4257 This exploits CVE-2026-4257, a Server-Side Template Injection SSTI vulnerability in the "Contact Form" Wordpress plugin by Supsystic in versions 1.7.36 and before. This vulnerability allows an unauthenticated attacker to achieve Remote Code Execution. The vulnerability exists in the...

CVE-2026-4800-POC

CVE-2026-4800-POC Security Advisory https://github.com/lodash/lodash/security/advisories/GHSA-r5fr-rjxr-66jc POC const = require'lodash'; Object.prototype.imports = 'x=process.getBuiltinModule"childprocess".execSync"curl https://example.com"':undefined .template'', ; Flow Using a prior prototype...

CVE-2024-40111-Exploit

CVE-2024-40111: Stored Cross-Site Scripting XSS in Automad 2.0.0-alpha.4 Exploit Details Exploit Title : Stored Cross-Site Scripting XSS in Automad 2.0.0-alpha.4 Date : 2024-06-20 Exploit Author : Jerry Thomas w3bn00b3r Vendor Homepage : Automad Software Link : Automad GitHub Repository Category ...

CVE-2025-32463

CVE-2025-32463 - Setup and Execution Guide This is the first time I’ve ported a malicious exploit into a Nuclei template for a non-intrusive vulnerability scan that still demonstrates the underlying issue. I documented the process in more detail expressly as a learning exercise. My main challenge...

CVE-2026-33154

Dynaconf SSTI Vulnerability Report Summary Dynaconf is vulnerable to Server-Side Template Injection SSTI due to unsafe template evaluation in the @Jinja resolver. When the jinja2 package is installed, Dynaconf evaluates template expressions embedded in configuration values without a sandboxed...

CVE-2024-50603

CVE-2024-50603 CVE-2024-50603-nuclei-poc...

CVE-2025-24893-RCE-PoC

Infos This PoC first tests for the SSTI and if it works. It will go in loop and allows you to run commands remotly. The exec and shell command do the same currently. Installation python3 -m pip install requirements.txt Usage Connecting python3 poc.py Example With debug set to False default python...

CVE-2026-22812

CVE-2026-22812 CVE-2026-22812 - OpenCode Unauthenticated RCE Nuclei template for scan. burp suite request POST /session HTTP/1.1 Host: target.com User-Agent: Mozilla/5.0 X11; Linux x8664 Content-Type: application/json Content-Length: 2 POST /session/"id"/shell HTTP/1.1 Host: target.com User-Agent...

CVE-2026-22785

CVE-2026-22785 Reproduction Tutorial Vulnerability Overview CVE : CVE-2026-22785 Impact : orval = 7.18.0 CVSS : 9.3 CRITICAL Type : Code Injection Vulnerability Principle orval Example python cvetool.py shell whoami python cvetool.py shell "node --version" python cvetool.py shell dir Scan files...

CVE-2026-55240

The Tianji open-source analytics and monitoring platform is vulnerable to Remote Code Execution (RCE) in versions prior to 1.31.29 . The root cause is that the formatString() function in src/server/utils/template.ts passes survey and monitor notification templates to the lodash template function ...

CVE-2026-55240 Tianji: Remote Code Execution via lodash template evaluate pattern in survey feed templates

Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, formatString in src/server/utils/template.ts passes survey feedTemplate and monitor notification templates to lodash template, while the default evaluate pattern remains enabled. A workspace...

CVE-2026-25731

Server-Side Template Injection SSTI in Templite Engine Severity: High CVSS 7.8 Affected Software: calibre Patched In: 9.2.0 Advisory: GHSA-xrh9-w7qx-3gcc Summary A Server-Side Template Injection SSTI vulnerability in Calibre's Templite templating engine allows arbitrary code execution when a user...

CVE-2026-34724

🚨 CVE-2026-34724 - Zammad 7.0.1 - Server-Side Template Injection SSTI to Remote Code Execution RCE via AI Agent 📌 Overview Zammad is a popular open-source web-based helpdesk and customer support system. CVE-2026-34724 is a Server-Side Template Injection SSTI vulnerability in the new AI Agent...

astro_CVE-2026-33532

Astro Starter Kit: Minimal npm create astro@latest -- --template minimal 🧑‍🚀 Seasoned astronaut? Delete this file. Have fun! 🚀 Project Structure Inside of your Astro project, you'll see the following folders and files: / ├── public/ ├── src/ │ └── pages/ │ └── index.astro └── package.json Astro...

InvenTree-Path-Traversal-CVE-2026-33531

CVE-2026-33531 — Path Traversal in InvenTree Report Templates Advisory: GHSA-rhc5-7c3r-c769 CVE: CVE-2026-33531 Severity: Medium Published: 2026-03-20 Credit: @alonaki Description A path traversal vulnerability in the report template engine allows a staff-level user to read arbitrary files from t...

jinjava-cve-2026-25526-poc

Step-by-step exploit all 9 steps: mvn exec:java -Dexec.mainClass=ExploitHarness -q 2. Final exploit chains file creation, file read, info disclosure: mvn exec:java -Dexec.mainClass=ExploitFinal -q 3. File content exfiltration reads /etc/passwd, /etc/hosts: mvn exec:java...

CVE-2025-24893

Infos This PoC first tests for the SSTI and if it works. It will go in loop and allows you to run commands remotly. The exec and shell command do the same currently. Usage Connecting python3 poc.py Example With debug set to False default python3 poc.py http://127.0.0.1:8080 Targeting...