CVE-2025-27406 Icinga Reporting Stored XSS leads to SSRF

Icinga Reporting is the central component for reporting related functionality in the monitoring web frontend and framework Icinga Web 2. A vulnerability present in versions 0.10.0 through 1.0.2 allows to set up a template that allows to embed arbitrary Javascript. This enables the attacker to act...

Security Bulletin: IBM Maximo Application Suite Ai-Broker Component vulnerable to arbitrary code execution

Summary Security Bulletin: IBM Maximo Application Suite Ai-Broker Component Security Bulletin: IBM Maximo Application Suite Predict Component may be vulnerable to arbitrary code execution of Python code through the use of Jinja. This bulletin contains information regarding the vulnerability and i...

CVE-2024-29202

JumpServer is an open source bastion host and an operation and maintenance security audit system. Attackers can exploit a Jinja2 template injection vulnerability in JumpServer's Ansible to execute arbitrary code within the Celery container. Since the Celery container runs with root privileges and...

CVE-2024-55028

A template injection vulnerability in the Dashboard of NASA Fprime v3.4.3 allows attackers to execute arbitrary code via uploading a crafted Vue file...

PYSEC-2025-114

A template injection vulnerability in the Dashboard of NASA Fprime v3.4.3 allows attackers to execute arbitrary code via uploading a crafted Vue file...

PYSEC-2025-114

A template injection vulnerability in the Dashboard of NASA Fprime v3.4.3 allows attackers to execute arbitrary code via uploading a crafted Vue file...

[SECURITY] Fedora 40 Update: python-jinja2-3.1.6-1.fc40

Jinja2 is a template engine written in pure Python. It provides a Django inspired non-XML syntax but supports inline expressions and an optional sandboxed environment. If you have any exposure to other text-based template languages, such as Smarty or Django, you should feel right at home with...

CVE-2024-55028

A template injection vulnerability in the Dashboard of NASA Fprime v3.4.3 allows attackers to execute arbitrary code via uploading a crafted Vue file...

CVE-2024-55028

A template injection vulnerability in the Dashboard of NASA Fprime v3.4.3 allows attackers to execute arbitrary code via uploading a crafted Vue file...

fprime 代码注入漏洞

fprime is a NASA open source framework for flight software and embedded systems. A security vulnerability exists in fprime v3.4.3, which stems from template injection in the dashboard and could lead to an attacker executing arbitrary code by uploading a specially crafted Vue file...

CVE-2024-55028

A template injection vulnerability in the Dashboard of NASA Fprime v3.4.3 allows attackers to execute arbitrary code via uploading a crafted Vue file...

CVE-2024-55028

CVE-2024-55028 affects NASA Fprime v3.4.3 Dashboard via a template injection in the Vue-based dashboard that enables arbitrary code execution when uploading a crafted Vue file. Reported metrics show a CRITICAL CVSS 3.1 base score (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) with network exploitation, no...

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation through the auth-tls-match-cn annotation. An attacker can execute arbitrary code and disclose sensitive information by injecting malicious configurations. Remediation Upgrade...

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation through the auth-tls-match-cn annotation. An attacker can execute arbitrary code and disclose sensitive information by injecting malicious configurations. Remediation Upgrade...

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation through the mirror-target and mirror-host annotations. Remediation Upgrade k8s.io/ingress-nginx/internal/ingress/controller/template to version 1.11.5, 1.12.1, 4.11.5, 4.12.1 or higher. References - GitHub Comm...

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation through the mirror-target and mirror-host annotations. Remediation Upgrade github.com/kubernetes/ingress-nginx/internal/ingress/controller/template to version 1.11.5, 1.12.1, 4.11.5, 4.12.1 or higher. Reference...

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Amendment This was deemed not a vulnerability. Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' in the $ shell API due to improper neutralization of user input. An attacker can exploit this by...

Exploit for CVE-2025-29927

nextjs-CVE-2025-29927 A Nuclei template to detect CVE-2025-299...

CVE-2024-7476

A broken access control vulnerability exists in lunary-ai/lunary versions 1.2.7 through 1.4.2. The vulnerability allows an authenticated attacker to modify any user's templates by sending a crafted HTTP POST request to the /v1/templates/id/versions endpoint. This issue is resolved in version 1.4....

CVE-2024-6986

A Cross-site Scripting XSS vulnerability exists in the Settings page of parisneo/lollms-webui version 9.8. The vulnerability is due to the improper use of the 'v-html' directive, which inserts the content of the 'fulltemplate' variable directly as HTML. This allows an attacker to execute maliciou...