DEBIAN-CVE-2023-29827

ejs v3.1.9 is vulnerable to server-side template injection. If the ejs file is controllable, template injection can be implemented through the configuration settings of the closeDelimiter parameter. NOTE: this is disputed by the vendor because the render function is not intended to be used with...

UBUNTU-CVE-2023-29827

DISPUTED ejs v3.1.9 is vulnerable to server-side template injection. If the ejs file is controllable, template injection can be implemented through the configuration settings of the closeDelimiter parameter. NOTE: this is disputed by the vendor because the render function is not intended to be us...

PT-2023-22433

Name of the Vulnerable Software and Affected Versions ejs version 3.1.9 Description The issue concerns server-side template injection. If the ejs file is controllable, template injection can be implemented through the configuration settings of the closeDelimiter parameter. It is noted that the...

CVE-2023-0232

The ShopLentor WordPress plugin before 2.5.4 unserializes user input from cookies in order to track viewed products and user data, which could lead to PHP Object Injection...

RCE by Server Side Template Injection

Description Hi, During my testing, I discovered that it is possible to inject code into the system through the "first name" field. This vulnerability allows for server-side template injection, which can lead to arbitrary code execution. The impact of this vulnerability is potentially significant...

CVE-2022-47896

In JetBrains IntelliJ IDEA before 2022.3.1 code Templates were vulnerable to SSTI attacks...

CVE-2022-39365 RCE vulnerability in Pimcore/Mail & Dynamic Text Layout

Pimcore is an open source data and experience management platform. Prior to version 10.5.9, the user controlled twig templates rendering in Pimcore/Mail & ClassDefinition\Layout\Text is vulnerable to server-side template injection, which could lead to remote code execution. Version 10.5.9 contain...

CVE-2022-39824

Server-side JavaScript injection in Appsmith through 1.7.14 allows remote attackers to execute arbitrary JavaScript code from the server via the currentItem property of the list widget, e.g., to perform DoS attacks or achieve an information leak...

Appsmith Cross-site Scripting Vulnerability

Appsmith is an open source platform from Appsmith Open Source for building, deploying and maintaining internal applications. A security vulnerability exists in Appsmith version 1.7.14, which originates from server-side JavaScript injection and allows remote attackers to execute arbitrary JavaScri...

Grav code injection vulnerability

Grav is an extensible CMS Content Management System for personal blogs, small content publishing platforms, and one-page product displays. A security vulnerability exists in Grav versions prior to 1.7.34, which stems from Grav's vulnerability to server-side template injection via Twig...

GHSA-PHWQ-J96M-2C2Q ejs template injection vulnerability

The ejs aka Embedded JavaScript templates package 3.1.6 for Node.js allows server-side template injection in settingsview optionsoutputFunctionName. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command which is executed upon template...

DEBIAN-CVE-2022-29078

The ejs aka Embedded JavaScript templates package 3.1.6 for Node.js allows server-side template injection in settingsview optionsoutputFunctionName. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command which is executed upon template...

CVE-2022-29078

The ejs aka Embedded JavaScript templates package 3.1.6 for Node.js allows server-side template injection in settingsview optionsoutputFunctionName. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command which is executed upon template...

PT-2022-3563

Name of the Vulnerable Software and Affected Versions ejs versions 3.1.6 Description The issue is related to the ejs package for Node.js, which allows server-side template injection in settingsview optionsoutputFunctionName. This can be parsed as an internal option and overwrites the...

Github ejs code injection vulnerability

Github ejs is an embedded JavaScript template. A code injection vulnerability exists in ejs version 3.1.6, which stems from server-side template injection being possible in settingsview optionsoutputFunctionName. This is parsed as an internal option and the outputFunctionName option is overridden...

CVE-2022-22954

VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A malicious actor with network access can trigger a server-side template injection that may result in remote code execution...

CVE-2021-40219

Bolt CMS

PT-2022-2145

Name of the Vulnerable Software and Affected Versions VMware Workspace ONE Access and Identity Manager VMware Cloud Foundation vRealize Suite Lifecycle Manager Description The software contains a remote code execution issue due to a server-side template injection. A malicious actor with network...

CVE-2021-44618

A Server-side Template Injection SSTI vulnerability exists in Nystudio107 Seomatic 3.4.12 in src/helpers/UrlHelper.php via the host header...

Nystudio107 Seomatic: Code Injection Vulnerability

Nystudio107 Seomatic is a comprehensive, powerful and flexible turnkey SEO system in the USA. Facilitates modern SEO best practices and implementation of Craft CMS 3. A security vulnerability exists in Nystudio107 Seomatic version 3.4.12, which stems from a lack of filtering and escaping of...