CVE-2021-46361

CVE-2021-46361: FreeMarker Restriction Bypass in Magnolia CMS An issue in the FreeMarker Filter of Magnolia CMS v6.2.11 and below allows attackers to bypass security restrictions and execute arbitrary code via a crafted FreeMarker payload. Vendor Disclosure: The vendor's disclosure and fix for th...

VMware-CVE-2022-22954-Command-Injector

VMware-CVE-2022-22954-Command-Injector Proof of Concept for exploiting VMware CVE-2022-22954 How it works This simple Python script makes a GET request to the specified URL appended with /catalog-portal/ui/oauth/verify?error=&deviceUdid= and then followed by a URL encoded version of this string:...

CVE-2026-94109

openEQUELLA versions before 2026.1.0 are affected by a remote code execution vulnerability in FreeMarker template compilation, caused by an unsandboxed TemplateClassResolver configuration. Authenticated attackers can inject malicious template expressions via collection summaries , dashboard portl...

CVE-2026-31380 Apache OFBiz: FreeMarker SSTI via Duplicate Parameter Sanitization Bypass

Improper Neutralization of Special Elements used in an Expression Language Statement 'Expression Language Injection' vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue...

JFrog Artifactory FreeMarker Template Injection Vulnerability

Artifactory is a full-featured component manager from JFrog. A template injection vulnerability exists in Artifactory FreeMarker, which can be exploited by an attacker to An attacker can use this vulnerability to read or write arbitrary files and execute code on an instance of Artifactory...