684 matches found
CVE-2021-46063: Improper Control of Generation of Code
MCMS v5.2.5 was discovered to contain a Server Side Template Injection SSTI vulnerability via the Template Management module...
CVE-2021-46362
A Server-Side Template Injection SSTI vulnerability in the Registration and Forgotten Password forms of Magnolia v6.2.3 and below allows attackers to execute arbitrary code via a crafted payload entered into the fullname parameter...
Sql injection
A Server-Side Template Injection SSTI vulnerability in the Registration and Forgotten Password forms of Magnolia v6.2.3 and below allows attackers to execute arbitrary code via a crafted payload entered into the fullname parameter...
CVE-2021-46362
A Server-Side Template Injection SSTI vulnerability in the Registration and Forgotten Password forms of Magnolia v6.2.3 and below allows attackers to execute arbitrary code via a crafted payload entered into the fullname parameter...
CVE-2021-46362
Magnolia CMS is affected by a Server-Side Template Injection (SSTI) in the Registration and Forgotten Password forms via the fullname parameter for Magnolia versions prior to 6.2.3. The root cause is SSTI that can allow arbitrary code execution, with high-severity impact (CVSS 3.1: CRITICAL, base...
CVE-2021-46362: Improper Control of Generation of Code
A Server-Side Template Injection SSTI vulnerability in the Registration and Forgotten Password forms of Magnolia v6.2.3 and below allows attackers to execute arbitrary code via a crafted payload entered into the fullname parameter...
CVE-2021-44978
iCMS = 8.0.0 allows users to add and render a comtom template, which has a SSTI vulnerability which causes remote code execution...
Remote code execution
iCMS = 8.0.0 allows users to add and render a comtom template, which has a SSTI vulnerability which causes remote code execution...
CVE-2021-44978
iCMS = 8.0.0 allows users to add and render a comtom template, which has a SSTI vulnerability which causes remote code execution...
CVE-2021-44978
Summary: CVE-2021-44978 affects iCMS
CVE-2021-44978: Improper Control of Generation of Code
iCMS = 8.0.0 allows users to add and render a comtom template, which has a SSTI vulnerability which causes remote code execution...
Server side template injection — SSTI vulnerability ⚠️
Server side template injection — SSTI vulnerability ⚠️ Introduction There is hardly any software development or other linked elements that haven’t fallen into the trap of cyber vulnerabilities. Templates, used for HTML code management on the server-side, are amongst them. The attack targeting the...
com.gccloud:gc-starter-plugins-report-controller (>=1.0.0-beta, <=2.2.2.release), com.gccloud:gc-starter-plugins-report-server (>=1.0.0-beta, <=1.2.4.2024062001.release) +11 more potentially affected by CVE-2022-25767 via com.bstek.ureport:ureport2-console (>=2.0.0, <=2.2.9)
com.bstek.ureport:ureport2-console MAVEN version =2.0.0, =1.0.0-beta, =1.0.0-beta, =1.0.0-beta, =1.0.0-beta, =1.5.1, =1.5.1, =0.0.1, =1.1.0, =3.0.4-release, =2.0, =2.8.0, =4.2.0, =5.0.2 Source cves: CVE-2022-25767 Source advisory: SNYK:JAVA-COMBSTEKUREPORT-2322018...
Improper Privilege Management in dotcms/core
Description Hello team, I found a SSTI that allow me to get Full Privilege Escalation system user 1. While editing a template we have total access to the User and UserModel classes via $user 2. One of the UserModel methods is called setUserId 3. If we call setUserId and pass "system" as parameter...
Grav CMS 1.7.10 - Server-Side Template Injection (SSTI) (Authenticated) Exploit
Title: Grav CMS 1.7.10 - Server-Side Template Injection SSTI Authenticated Author: enox Vendor: https://getgrav.org/ Software Link: https://getgrav.org/download/core/grav-admin/1.7.10 Vulnerable Versions: Grav CMS 1.7.10 CVE: CVE-2021-29440 Credits:...
pwntools Server-Side Template Injection (SSTI) vulnerability
This affects the package pwntools before 4.3.1. The shellcraft generator for affected versions of this module are vulnerable to Server-Side Template Injection SSTI, which can lead to remote code execution...
GHSA-7XC5-GGPP-G249 pwntools Server-Side Template Injection (SSTI) vulnerability
This affects the package pwntools before 4.3.1. The shellcraft generator for affected versions of this module are vulnerable to Server-Side Template Injection SSTI, which can lead to remote code execution...
Server-Side Template Injection (SSTI)
freemarker is vulnerable to server-side template injection SSTI. By using java.security.ProtectionDomain.getClassLoader templates, an attacker is able to gain access to the classloader and subsequently the filesystem or execute arbitrary code on the host OS...