169 matches found
VulnNodeApp
VulnNodeApp 一个使用 node.js、express 服务器和 ejs 模板引擎构建的漏洞应用程序。此应用程序仅用于教育目的。 设置 克隆此仓库 git clone https://github.com/4auvar/VulnNodeApp.git 应用程序设置： 安装最新版本的 node.js 和 npm。 打开终端/命令提示符，导航到下载/克隆的仓库所在位置。 运行命令：npm install 数据库设置 安装并配置最新版本的 mysql，并启动 mysql 服务/守护进程。 使用 root 用户登录 mysql，并运行以下 sql 脚本： CREATE USER...
Embedded JavaScript(EJS) 3.1.6 - Template Injection
ejs v3.1.9 is vulnerable to server-side template injection. If the ejs file is controllable, template injection can be implemented through the configuration settings of the closeDelimiter parameter. id: CVE-2023-29827 info: name: Embedded JavaScriptEJS 3.1.6 - Template Injection author:...
CVE-2022-29078
CVE-2022-29078 CVE-2022-29078的简易PoC（漏洞ejs 3.1.6） 使用方法 git clone https://github.com/chuckdu21/CVE-2022-29078.git cd CVE-2022-29078 python3 CVE-2022-29078.py 将出现命令执行提示 $ id uid=0root gid=0root groupes=0root...
Node.js Embedded JavaScript 3.1.6 - Template Injection
Node.js Embedded JavaScript 3.1.6 is susceptible to server-side template injection via settingsview optionsoutputFunctionName, which is parsed as an internal option and overwrites the outputFunctionName option with an arbitrary OS command, which is then executed upon template compilation. id:...
CVE-2022-29078
CVE-2022-29078 | EJS SSTI → RCE White Hat School 4.ª generación clase 32 - Woo Sang-beom @taka3636 Resumen La vulnerabilidad de inyección de plantillas del lado del servidor SSTI en EJS , como en Hello . Internamente, EJS compila la cadena de la plantilla en una función de JavaScript y luego la...
CVE-2022-29078
CVE-2022-29078 漏洞 ejs 3.1.6 docker 设置 git clone https://github.com/miko550/CVE-2022-29078.git cd CVE-2022-29078 docker build . -t miko/vuln-ejs docker run -p 49160:8080 -d --name vuln-ejs miko/vuln-ejs 使用 http://127.0.0.1:49160/ 漏洞利用 在浏览器中 http://127.0.0.1:49160/page?id=2&settingsview...
PoC-CVE-2024-33883
CVE-2024-33883 [email protected]，原型污染验证不足导致RCE利用 利用原型污染，将opts.client设置为真值（条件） 然后，当render运行时，ejs会将opts.escapeFunction的值作为JS代码执行。 漏洞代码范围 基于[email protected] 1. ejs/lib/ejs.js - line 580, 636, 637 PoC（注入webshell并激活） 1. GET /pollute?target=client&value=1 2. GET...
vuln-ejs-critical
此存储库没有 README。...
SUSE CVE-2026-66077
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, The management UI uses EJS 1.0 in which does NOT HTML-escape. connection.ejs:135 renders and peercertissuer directly into the page. The same pattern appears in streamConnection.ejs:102,106,110. The...
Linux Distros Unpatched Vulnerability : CVE-2026-66077
"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, The management UI uses EJS 1.0 in which does NOT HTML-escap...
AZL-105792 CVE-2026-66077 affecting package rabbitmq-server 3.13.7-9
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, The management UI uses EJS 1.0 in which does NOT HTML-escape. connection.ejs:135 renders and peercertissuer directly into the page. The same pattern appears in streamConnection.ejs:102,106,110. The...
CVE-2026-66077
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, The management UI uses EJS 1.0 in which does NOT HTML-escape. connection.ejs:135 renders and peercertissuer directly into the page. The same pattern appears in streamConnection.ejs:102,106,110. The...
CVE-2026-66077
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, The management UI uses EJS 1.0 in which does NOT HTML-escape. connection.ejs:135 renders and peercertissuer directly into the page. The same pattern appears in streamConnection.ejs:102,106,110. The...
CVE-2026-66077
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, The management UI uses EJS 1.0 in which does NOT HTML-escape. connection.ejs:135 renders and peercertissuer directly into the page. The same pattern appears in streamConnection.ejs:102,106,110. The...
CVE-2026-66077
RabbitMQ versions prior to 3.13.15 , 4.0.20 , 4.1.11 , and 4.2.6 are vulnerable to Stored XSS via the management UI. The issue stems from the use of EJS 1.0 , where specific templates (connection.ejs and streamConnection.ejs) render the TLS peer-certificate Subject DN without HTML escaping. If a ...
EUVD-2026-85628
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, The management UI uses EJS 1.0 in which does NOT HTML-escape. connection.ejs:135 renders and peercertissuer directly into the page. The same pattern appears in streamConnection.ejs:102,106,110. The...
PT-2026-97561
Name of the Vulnerable Software and Affected Versions RabbitMQ versions prior to 3.13.15 RabbitMQ versions prior to 4.0.20 RabbitMQ versions prior to 4.1.11 RabbitMQ versions prior to 4.2.6 Description The management UI fails to HTML-escape data rendered via EJS 1.0. Specifically, the...
CVE-2026-66077: Improper Neutralization of Input During Web Page Generation
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, The management UI uses EJS 1.0 in which does NOT HTML-escape. connection.ejs:135 renders and peercertissuer directly into the page. The same pattern appears in streamConnection.ejs:102,106,110. The...
VulnCheck KEV: CVE-2023-29827
ejs v3.1.9 is vulnerable to server-side template injection. If the ejs file is controllable, template injection can be implemented through the configuration settings of the closeDelimiter parameter. NOTE: this is disputed by the vendor because the render function is not intended to be used with...
