PT-2025-29522

Name of the Vulnerable Software and Affected Versions: LaRecipe versions prior to 2.8.1 Description: LaRecipe is an application that allows users to create documentation with Markdown inside a Laravel app. Versions prior to 2.8.1 are vulnerable to Server-Side Template Injection SSTI, which could...

XWiki Platform SolrSearch Macro Remote Code Execution

XWiki Platform versions from 5.3-milestone-2 before 15.10.11 and from 16.0.0-rc-1 before 16.4.1 suffer from a Server-Side Template Injection SSTI due to the lack of sanitization of the SolrSearch Macro requests. By leveraging this vulnerability, a remote and unauthenticated attacker can achieve...

📄 Tiki Wiki CMS Groupware 28.3 Server-Side Template Injection

Tiki Wiki CMS Groupware versions 28.3 and below suffer from two server-side template injection vulnerabilities via specially crafted wiki pages. ---------------------------------------------------------------------------------- Tiki Wiki CMS Groupware '" The second vulnerability can be leveraged ...

BeyondTrust Remote Support (RS) 24.2.2 < 24.3.3 Server-Side Template Injection

The version of BeyondTrust Remote Support RS running on the remote host is affected by a server-side template injection vulnerability which can lead to remote code execution. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version...

CVE-2025-5309

The chat feature within Remote Support RS and Privileged Remote Access PRA is vulnerable to a Server-Side Template Injection vulnerability which can lead to remote code execution...

CVE-2025-5309

The chat feature within Remote Support RS and Privileged Remote Access PRA is vulnerable to a Server-Side Template Injection vulnerability which can lead to remote code execution...

CVE-2025-5309

The chat feature within Remote Support RS and Privileged Remote Access PRA is vulnerable to a Server-Side Template Injection vulnerability which can lead to remote code execution...

CVE-2025-5309 Remote Support & Privileged Remote Access server side template injection

The chat feature within Remote Support RS and Privileged Remote Access PRA is vulnerable to a Server-Side Template Injection vulnerability which can lead to remote code execution...

CVE-2025-5309 Remote Support & Privileged Remote Access server side template injection

The chat feature within Remote Support RS and Privileged Remote Access PRA is vulnerable to a Server-Side Template Injection vulnerability which can lead to remote code execution...

CVE-2025-5309

CVE-2025-5309 affects BeyondTrust Remote Support (RS) and BeyondTrust Privileged Remote Access (PRA) with a server‑side template injection in the chat feature, leading to remote code execution. The CVSS metrics in the initial entry indicate a critical/high impact across confidentiality, integrity...

PT-2025-25569 · Unknown · Privileged Remote Access +1

Name of the Vulnerable Software and Affected Versions: BeyondTrust Remote Support versions affected versions not specified BeyondTrust Privileged Remote Access versions affected versions not specified Description: The chat feature within Remote Support and Privileged Remote Access is vulnerable t...

CVE-2025-5309: Improper Control of Generation of Code

The chat feature within Remote Support RS and Privileged Remote Access PRA is vulnerable to a Server-Side Template Injection vulnerability which can lead to remote code execution...

Skyvern 0.1.85 - Remote Code Execution (RCE) via SSTI

Exploit Title: Skyvern 0.1.85 - Remote Code Execution RCE via SSTI Date: 2025-06-15 Exploit Author: Cristian Branet Vendor Homepage: https://www.skyvern.com/ Software Link: https://github.com/Skyvern-AI/skyvern Version: Settings - API Key - Reveal and copy the API key" parser.addargument"-i",...

PT-2025-24341

Name of the Vulnerable Software and Affected Versions Skyvern versions 0.1.0 through 0.1.85 Description The issue is related to a Jinja runtime leak in the sdk/workflow/models/block.py file. This leak can potentially be exploited, although specific details about real-world incidents or the...

CVE-2024-25624

Iris is a web collaborative platform aiming to help incident responders sharing technical details during investigations. Due to an improper setup of Jinja2 environment, reports generation in iris-web is prone to a Server Side Template Injection SSTI. Successful exploitation of the vulnerability c...

CVE-2024-52291

Craft is a content management system CMS. A vulnerability in CraftCMS allows an attacker to bypass local file system validation by utilizing a double file:// scheme e.g., file://file:////. This enables the attacker to specify sensitive folders as the file system, leading to potential file...

CVE-2024-32406

Server-Side Template Injection SSTI vulnerability in inducer relate before v.2024.1 allows a remote attacker to execute arbitrary code via a crafted payload to the Batch-Issue Exam Tickets function...

CVE-2024-22722

Server Side Template Injection SSTI vulnerability in Form Tools 3.1.1 allows attackers to run arbitrary commands via the Group Name field under the add forms section of the application...

CVE-2024-24724

Gibbon through 26.0.00 allows /modules/School%20Admin/messengerSettings.php Server Side Template Injection leading to Remote Code Execution because input is passed to the Twig template engine messengerSettings.php without sanitization...

CVE-2024-27516

Server-Side Template Injection SSTI vulnerability in livehelperchat before 4.34v, allows remote attackers to execute arbitrary code and obtain sensitive information via the search parameter in lhcweb/modules/lhfaq/faqweight.php...