CVE-2020-28246

CVE-2020-28246 describes a Server-Side Template Injection (SSTI) in Form.io 2.0.0 that leads to Remote Code Execution during the deletion of the default Email template URL. The vulnerability stems from the SSTI in the templating flow; the email templating service was removed after 2020, and Form....

CVE-2020-28246: Improper Neutralization of Special Elements in Output Used by a Downstream Component

A Server-Side Template Injection SSTI was discovered in Form.io 2.0.0. This leads to Remote Code Execution during deletion of the default Email template URL. NOTE: the email templating service was removed after 2020. Additionally, the vendor disputes this issue indicating this is sandboxed and on...

SEOmatic plugin for Craft CMS SSTI Vulnerability

A Server Side Template Injection SSTI was discovered in the SEOmatic plugin before 3.1.4 for Craft CMS, because requests that don't match any elements incorrectly generate the canonicalUrl, and can lead to execution of Twig code...

GHSA-6J9M-RP7M-3GFG SEOmatic plugin for Craft CMS SSTI Vulnerability

A Server Side Template Injection SSTI was discovered in the SEOmatic plugin before 3.1.4 for Craft CMS, because requests that don't match any elements incorrectly generate the canonicalUrl, and can lead to execution of Twig code...

CVE-2021-42651

A Server Side Template Injection SSTI vulnerability in Pentest-Collaboration-Framework v1.0.8 allows an authenticated remote attacker to execute arbitrary code through /project/PROJECTNAME/reports/...

CVE-2021-42651

A Server Side Template Injection SSTI vulnerability in Pentest-Collaboration-Framework v1.0.8 allows an authenticated remote attacker to execute arbitrary code through /project/PROJECTNAME/reports/...

CVE-2021-42651

A Server Side Template Injection SSTI vulnerability in Pentest-Collaboration-Framework v1.0.8 allows an authenticated remote attacker to execute arbitrary code through /project/PROJECTNAME/reports/...

CVE-2021-42651

CVE-2021-42651 describes a Server Side Template Injection (SSTI) in the open-source toolkit Pentest-Collaboration-Framework v1.0.8 . The vulnerability allows an authenticated remote attacker to execute arbitrary code via the path “/project/PROJECTNAME/reports/”. Root cause is SSTI in the server-s...

CVE-2021-42651: Improper Control of Generation of Code

A Server Side Template Injection SSTI vulnerability in Pentest-Collaboration-Framework v1.0.8 allows an authenticated remote attacker to execute arbitrary code through /project/PROJECTNAME/reports/...

Metasploit Wrap-Up

VMware Workspace ONE Access RCE Community contributor wvu has developed a new Metasploit Module which exploits CVE-2022-22954, an unauthenticated server-side template injection SSTI in VMware Workspace ONE Access, to execute shell commands as the ‘horizon’ user. This module has a CVSSv3 base scor...

VMware Workspace ONE Access Template Injection / Command Execution Exploit

This Metasploit module exploits CVE-2022-22954, an unauthenticated server-side template injection SSTI vulnerability in VMware Workspace ONE Access, to execute shell commands as the horizon user. This module requires Metasploit: https://metasploit.com/download Current source:...

VMware Workspace ONE Access Template Injection / Command Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'VMware Workspace ONE Access CVE-2022-22954', 'Description' = %q This module exploits CVE-2022-22954, an unauthenticated server-side template...

Exploit for Code Injection in Vmware Identity_Manager

CVE-2022-22954 CVE-2022-22954 VMware Workspace ONE Access free...

Exploit for Code Injection in Vmware Identity_Manager

CVE-2022-22954 PoC VMware Workspace ONE Access and Identity M...

CVE-2021-43097

A Server-side Template Injection SSTI vulnerability exists in bbs 5.3 in TemplateManageAction.javawhich could let a malicoius user execute arbitrary code...

CVE-2021-43097

A Server-side Template Injection SSTI vulnerability exists in bbs 5.3 in TemplateManageAction.javawhich could let a malicoius user execute arbitrary code...

Sql injection

A Server-side Template Injection SSTI vulnerability exists in bbs 5.3 in TemplateManageAction.javawhich could let a malicoius user execute arbitrary code...

CVE-2021-43097

A Server-side Template Injection SSTI vulnerability exists in bbs 5.3 in TemplateManageAction.javawhich could let a malicoius user execute arbitrary code...

CVE-2021-43097

The provided connected documents indicate CVE-2021-43097 affects the bbs 5.3 web application, specifically a Server-side Template Injection (SSTI) in TemplateManageAction.java that could allow a malicious user to execute arbitrary code. This establishes the component/file and the underlying vulne...

CVE-2021-26622

An remote code execution vulnerability due to SSTI vulnerability and insufficient file name parameter validation was discovered in Genian NAC. Remote attackers are able to execute arbitrary malicious code with SYSTEM privileges on all connected nodes in NAC through this vulnerability...