CVE-2022-29078

CVE-2022-29078 vuln ejs 3.1.6 docker Setup root@kitploit: git clone https://github.com/miko550/CVE-2022-29078.git cd CVE-2022-29078 docker build . -t miko/vuln-ejs docker run -p 49160:8080 -d --name vuln-ejs miko/vuln-ejs Usage root@kitploit: http://127.0.0.1:49160/ Exploit In browser...

SSTImap

SSTImap This project is based on Tplmap. SSTImap is a penetration testing software that can check websites for Code Injection and Server-Side Template Injection vulnerabilities and exploit them, giving access to the operating system itself. This tool was developed to be used as an interactive...

CVE-2024-4040-SSTI-LFI-PoC

CVE-2024-4040 SSTI & LFI PoC - Exploitation | CrushFTP This is a proof of concept for a Server Side Template Injection SSTI & Local File Inclusion LFI vulnerability in CrushFTP. Features Taking leverage of Critical Severity Vulnerabilities in CrushFTP servers through Server Side Template Injectio...

tplmap

Tplmap 本项目已不再维护。只要不破坏测试套件，我会合并新的PR。 Tplmap 协助利用代码注入和服务器端模板注入漏洞，借助多种沙箱逃逸技术，获取底层操作系统的访问权限。 该工具及其测试套件旨在研究 SSTI 漏洞类别，并作为 Web 应用程序渗透测试中的进攻性安全工具使用。 沙箱逃逸技术源自 James Kett 的服务器端模板注入：现代 Web 应用的 RCE、其他公开研究 1 2，以及本工具的原創贡献3 4。 它可以利用多种代码上下文和盲注入场景。它还支持 Python、Ruby、PHP、Java 中的类似 eval 的代码注入以及通用的非沙箱模板引擎。 服务器端模板注入...

CVE-2024-4040

CVE-2024-4040 A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform...

VMware-CVE-2022-22954

VMware CVE-2022-22954 Workspace ONE Access Freemarker Server-side Template Injection POC for Vmware CVE-2022-22954 Use this one line GET request!! This will execute cat /etc/passwd...

CVE-2021-26121

CS-Cart templates.manage Server Side Template Injection Remote Code Execution Vulnerability Found by: Steven Seeley of 360 Vulcan Team Version: = 4.12.x latest Date: 2021-01-08 12:49 CVE: CVE-2021-26121 Disclosure Timeline 2021-01-26 – Sent to CSCart dev team 2021-01-27 – Notification of reciept...

MAL-001

MAL-001: FreeMarker Server-Side Template Injection in Liferay Portal Se descubrió un problema en Liferay - Portal =7.4.3.12-ga12. Al insertar contenido malicioso en las plantillas FTL, un atacante puede realizar ataques SSTI Server-Side Template Injection, que pueden aprovechar los objetos...

CVE-2022-24086

CVE-2022-24086 Tested with: magento 2.4.3 and sample data Docker image: docker.io/bitnami/magento:2.4.3-debian-10-r0 First Name: root@kitploit: var this.getTemplateFilter.filter$order.shippingaddress.cityvar...

GenCrushSSTIExploit

EN GenCrushSSTIExploit is a PoC exploit tool targeting the SSTI Server-Side Template Injection vulnerability in CrushFTP CVE-2024-4040. This tool demonstrates how to exploit this vulnerability for educational and ethical hacking purposes only. Features Establishes a session with the CrushFTP serv...

GenGravSSTIExploit

EN GenGravSSTIExploit is a PoC Python script that exploits an authenticated Server-Side Template Injection SSTI vulnerability in Grav CMS versions = 1.7.44 CVE-2024-28116. This vulnerability allows a user with editor permissions to execute OS commands on a remote server. Note : This script requir...

CVE-2023-30145

Description: Camaleon CMS v2.7.0 was discovered to contain a Server-Side Template Injection SSTI vulnerability via the formats parameter. Affected Component: All versions that are below 2.7.0 Fixed version: Fixed Versions: 2.7.4 Step to reproduce : Detection: 1.open below...

Hitachi Pentaho Business Analytics Server - Remote Code Execution

Hitachi Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x, is susceptible to remote code execution via server-side template injection. Certain web services can set property values which contain Spring templates that are interpreted downstream, thereby...

playSMS <1.4.3 - Remote Code Execution

PlaySMS before version 1.4.3 is susceptible to remote code execution because it double processes a server-side template. id: CVE-2020-8644 info: name: playSMS 1.4.3 - Remote Code Execution author: dbrwsky severity: critical description: PlaySMS before version 1.4.3 is susceptible to remote code...

CVE-2022-22954_VMware_PoC

CVE-2022-22954 PoC - Inyección de plantillas del lado del servidor Freemarker en VMware Workspace ONE Access Se ha encontrado una vulnerabilidad, clasificada como muy crítica, en Vmware Workspace ONE Access e Identity Manager. El componente afectado es Template Handler. Referencia:...

cve-2026-4257

CVE-2026-4257 Esto explota CVE-2026-4257, una vulnerabilidad de inyección de plantillas del lado del servidor SSTI en el plugin "Contact Form" de Wordpress de Supsystic en las versiones 1.7.36 y anteriores. Esta vulnerabilidad permite a un atacante no autenticado lograr la ejecución remota de...

CVE-2026-33154

Dynaconf SSTI Vulnerability Report Summary Dynaconf is vulnerable to Server-Side Template Injection SSTI due to unsafe template evaluation in the @Jinja resolver. When the jinja2 package is installed, Dynaconf evaluates template expressions embedded in configuration values without a sandboxed...

CVE-2026-34724

🚨 CVE-2026-34724 - Zammad 7.0.1 - Server-Side Template Injection SSTI to Remote Code Execution RCE via AI Agent 📌 Overview Zammad is a popular open-source web-based helpdesk and customer support system. CVE-2026-34724 is a Server-Side Template Injection SSTI vulnerability in the new AI Agent...

CVE-2026-25731

Inyección de Plantillas del Lado del Servidor SSTI en el Motor Templite Gravedad: Alta CVSS 7.8 Software afectado: calibre Corregido en: 9.2.0 Aviso: GHSA-xrh9-w7qx-3gcc Resumen Una vulnerabilidad de Inyección de Plantillas del Lado del Servidor SSTI en el motor de plantillas Templite de Calibre...

CVE-2025-24893

Infos Este PoC primero prueba la SSTI y, si funciona, entra en un bucle y te permite ejecutar comandos de forma remota. Los comandos exec y shell hacen lo mismo actualmente. Uso Conexión root@kitploit: python3 poc.py Ejemplo Con debug establecido en False por defecto root@kitploit: python3 poc.py...