EUVD-2024-28293

Malicious code in bioql PyPI...

EUVD-2024-52978

Malicious code in bioql PyPI...

EUVD-2021-32423

Malicious code in bioql PyPI...

EUVD-2023-29965

Malicious code in bioql PyPI...

EUVD-2025-30832

Malicious code in bioql PyPI...

CVE-2025-10380

The Advanced Views – Display Posts, Custom Fields, and More plugin for WordPress is vulnerable to Server-Side Template Injection in all versions up to, and including, 3.7.19. This is due to insufficient input sanitization and lack of access control when processing custom Twig templates in the Mod...

PT-2025-39110

Name of the Vulnerable Software and Affected Versions Advanced Views – Display Posts, Custom Fields, and More plugin for WordPress versions up to and including 3.7.19 Description The Advanced Views – Display Posts, Custom Fields, and More plugin for WordPress is susceptible to Server-Side Templat...

CVE-2025-54815

Server-side template injection SSTI vulnerability in PPress 0.0.9 allows attackers to execute arbitrary code via crafted themes...

CVE-2025-9556

Langchaingo supports the use of jinja2 syntax when parsing prompts, which is in turn parsed using the gonja library v1.5.3. Gonja supports include and extends syntax to read files, which leads to a server side template injection vulnerability within langchaingo, allowing an attacker to insert a...

CVE-2025-9556 CVE-2025-9556

Langchaingo supports the use of jinja2 syntax when parsing prompts, which is in turn parsed using the gonja library v1.5.3. Gonja supports include and extends syntax to read files, which leads to a server side template injection vulnerability within langchaingo, allowing an attacker to insert a...

LangChain Go security vulnerabilities

LangChain Go is a simple framework for writing LLM-based programs in Go by the individual developer Travis Cline. A security vulnerability exists in LangChain Go version 0.1.14, which stems from support for include and extends syntax for reading files, and could lead to a server-side template...

CVE-2025-58642 WordPress LTL Freight Quotes – Day & Ross Edition Plugin <= 2.1.11 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in enituretechnology LTL Freight Quotes – Day & Ross Edition ltl-freight-quotes-day-ross-edition allows Object Injection.This issue affects LTL Freight Quotes – Day & Ross Edition: from n/a through = 2.1.11...

Linux Distros Unpatched Vulnerability : CVE-2021-25283

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in through SaltStack Salt before 3002.5. The jinja renderer does not protect against server side template injection attacks...

Dell NetWorker Management Console Server-Side Injection Code Execution

The vulnerability of the Dell NetWorker Management Console’s application and database servers is related to the lack of measures taken to neutralize server-side injection attacks. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

CVE-2025-52122

Freeform 5.0.0 to before 5.10.16, a plugin for CraftCMS, contains an Server-side template injection SSTI vulnerability, resulting in arbitrary code injection for all users that have access to editing a form submission title...

CVE-2025-51991

XWiki versions through 17.3.0 are vulnerable to Server-Side Template Injection (SSTI) in the Administration interface . The flaw exists in the HTTP Meta Info field of the Global Preferences Presentation section due to improper validation or sandboxing of Apache Velocity template code. An authenti...

CVE-2025-51991

XWiki through version 17.3.0 is vulnerable to Server-Side Template Injection SSTI in the Administration interface, specifically within the HTTP Meta Info field of the Global Preferences Presentation section. An authenticated administrator can inject crafted Apache Velocity template code, which is...

Linux Distros Unpatched Vulnerability : CVE-2023-29827

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ejs v3.1.9 is vulnerable to server-side template injection. If the ejs file is controllable, template injection can be implemented through the configuration...

WordPress plugin integrations for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms – code issues and vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A code issue vulnerability exists ...

mailcow: Dockerized security vulnerabilities

mailcow: dockerized is a dockerized mailcow application from mailcow open source. A security vulnerability exists in versions prior to mailcow: dockerized 2025-07 that stems from a server-side template injection in the notification template system that could lead to code execution...