CVE-2026-25731

Server-Side Template Injection SSTI in der Templite-Engine Schweregrad: Hoch CVSS 7.8 Betroffene Software: calibre Behoben in: 9.2.0 Advisory: GHSA-xrh9-w7qx-3gcc Zusammenfassung Eine Server-Side Template Injection SSTI-Schwachstelle in Calibres Templite-Template-Engine ermöglicht die Ausführung...

CVE-2026-34724

🚨 CVE-2026-34724 - Zammad 7.0.1 - Iniezione di Template Lato Server SSTI per Esecuzione di Codice Remoto RCE tramite Agente AI 📌 Panoramica Zammad è un popolare sistema di helpdesk e supporto clienti open-source basato sul web. CVE-2026-34724 è una vulnerabilità di Iniezione di Template Lato Serv...

CVE-2025-24893

Infos Dieser PoC testet zuerst auf die SSTI und prüft, ob sie funktioniert. Danach geht er in eine Schleife und ermöglicht es dir, Befehle remote auszuführen. Die Befehle exec und shell tun derzeit dasselbe. Verwendung Verbinden python3 poc.py Beispiel Mit debug auf False gesetzt Standard python3...

SSTI-Exploit-Detector

SSTI-Exploit-Detector SSTI Exploit Detector ist ein Tool zur Erkennung potenzieller Server-Side Template Injection SSTI -Schwachstellen in Webanwendungen. SSTI-Exploit-Detector Jenderal92 Funktionen Benutzerdefinierte Payload-Datei : Ermöglicht Benutzern, eigene Payloads hinzuzufügen, um...

POC_CVE-2025-14700

CVE-2025-14700 PoC für CVE-2025-14700 , eine Server-Side Template Injection SSTI-Schwachstelle in Crafty Controller = 4.6.1. Diese Schwachstelle ermöglicht es authentifizierten Benutzern, durch das Einschleusen bösartiger Jinja2-Vorlagen in die Webhook-Konfiguration Remote-Codeausführung RCE zu...

CVE-2024-32651-changedetection-RCE

CVE-2024-32651 changedetection 0.45.20 - Esecuzione di Codice Remota RCE Exploit di Iniezione di Template Lato Server!! 1. Titolo Esecuzione di Codice Remota tramite Iniezione di Template Lato Server SSTI in Applicazione Web Vulnerabile 2. Descrizione Questo exploit prende di mira un'applicazione...

CVE-2024-6386-WPML-SSTI

Questo repository non contiene un README...

CVE-2022-22954

CVE-2022-22954 PoC VMware Workspace ONE Access and Identity Manager RCE über SSTI. CVE-2022-22954 - PoC SSTI Verwendung: CVE-2022-22954.py -h -m SETMODE -i IP -c CMD optional arguments: -h, --help show this help message and exit -m SETMODE, --mode SETMODE Available modes: shodan | file | manual -...

Linked Field - Moderately critical - Server-side template injection - SA-CONTRIB-2026-200

This module enables you to link the output of a field to a URL or to the value of another field. The module doesn't sufficiently separate field content from template code when rendering linked field output. Depending on the Twig extensions installed on the site, this can be used to expose site...

Security update for python-fsspec (important)

openSUSE security update: security update for python-fsspec ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22028-1 Rating: important References: bsc1284173 Cross-References: CVE-2026-104851 Affected Products: openSUSE Leap 16.0...

EUVD-2026-93660

NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can add custom links" permission to steal session cookies and API tokens of other users by exposing the raw Django HttpRequest object to the Jinja2 template contex...

CVE-2026-104073

NetBox versions 2.9.5 before 4.7.0 are vulnerable to a server-side template injection vulnerability. A low-privileged user with the "Can add custom links" permission can exploit this by exposing the raw Django HttpRequest object to the Jinja2 template context. An attacker can craft a custom link ...

CVE-2026-104073 NetBox 2.9.5 < 4.7.0 Session Hijacking via Custom Links

NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can add custom links" permission to steal session cookies and API tokens of other users by exposing the raw Django HttpRequest object to the Jinja2 template contex...

CVE-2026-104073 NetBox 2.9.5 < 4.7.0 Session Hijacking via Custom Links

NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can add custom links" permission to steal session cookies and API tokens of other users by exposing the raw Django HttpRequest object to the Jinja2 template contex...

CVE-2026-104073 NetBox 2.9.5 < 4.7.0 Session Hijacking via Custom Links

NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can add custom links" permission to steal session cookies and API tokens of other users by exposing the raw Django HttpRequest object to the Jinja2 template contex...

CVE-2022-40634

CVE-2022-40634: FreeMarker Server-Side Template Injection in CrafterCMS Durch das Einfügen schädlicher Inhalte in eine FTL-Vorlage kann ein Angreifer SSTI-Angriffe Server-Side Template Injection durchführen, die offengelegte FreeMarker-Objekte ausnutzen können, um Einschränkungen zu umgehen und R...

CVE-2022-25813

CVE-2022-25813: Iniezione di Template lato server FreeMarker in Apache OfBiz Inserendo contenuti malevoli nel campo "Oggetto" di un messaggio, un attaccante può effettuare attacchi SSTI Server-Side Template Injection, che possono sfruttare gli oggetti esposti di FreeMarker per bypassare le...

OPENSUSE-SU-2026:22028-1 Security update for python-fsspec

This update for python-fsspec fixes the following issues: Changes in python-fsspec: - CVE-2026-104851: python-fsspec: remote code execution via server-side template injection in ReferenceFileSystem bsc1284173...

CVE-2023-49964

CVE-2023-49964: Iniezione di Template Lato Server di FreeMarker in Alfresco È stato scoperto un problema in Hyland Alfresco Community Edition =7.2.0. Inserendo contenuti dannosi nel file folder.get.html.ftl, un attaccante può effettuare attacchi SSTI Server-Side Template Injection, che possono...

PT-2026-106848

NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can add custom links" permission to steal session cookies and API tokens of other users by exposing the raw Django HttpRequest object to the Jinja2 template contex...