CVE-2023-30145

Camaleon CMS is affected: versions below 2.7.0 contain a Server-Side Template Injection (SSTI) via the formats parameter in the admin media/upload flow. The root cause is SSTI in the template handling of the formats field, enabling potentially arbitrary code execution. Documented details include ...

CVE-2023-30145

Camaleon CMS v2.7.0 was discovered to contain a Server-Side Template Injection SSTI vulnerability via the formats parameter...

CVE-2023-30145: Improper Control of Generation of Code

Camaleon CMS v2.7.0 was discovered to contain a Server-Side Template Injection SSTI vulnerability via the formats parameter...

CVE-2023-30145

Camaleon CMS v2.7.0 was discovered to contain a Server-Side Template Injection SSTI vulnerability via the formats parameter...

CVE-2023-30145

Camaleon CMS v2.7.0 was discovered to contain a Server-Side Template Injection SSTI vulnerability via the formats parameter...

Camaleon CMS v2.7.0 - Server-Side Template Injection (SSTI)

Exploit Title: Camaleon CMS v2.7.0 - Server-Side Template Injection SSTI Exploit Author: PARAG BAGUL CVE: CVE-2023-30145 Description Camaleon CMS v2.7.0 was discovered to contain a Server-Side Template Injection SSTI vulnerability via the formats parameter. Affected Component All versions below...

Server-Side Template Injection in Camaleon CMS

Camaleon CMS prior to 2.7.4 was discovered to contain a Server-Side Template Injection SSTI vulnerability via the formats parameter...

Server-Side Template Injection(SSTI)

com.ibeetl:beetl is vulnerable to Server-Side Template InjectionSSTI. A remote attacker is able to cause server-side template injection due to insufficient checks in render function via a crafted payload...

Pentaho Business Server Authentication Bypass / SSTI / Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Pentaho Business Server Auth Bypass and Server Side Template Injection RCE', 'Description' = %q Hitachi Vantara Pentaho Business Analytics Server...

CVE-2023-29827

ejs v3.1.9 is vulnerable to server-side template injection. If the ejs file is controllable, template injection can be implemented through the configuration settings of the closeDelimiter parameter. NOTE: this is disputed by the vendor because the render function is not intended to be used with...

Server-side template injection in beetl

An issue in the render function of beetl v3.15.0 allows attackers to execute server-side template injection SSTI via a crafted payload...

CVE-2023-30331

An issue in the render function of beetl v3.15.0 allows attackers to execute server-side template injection SSTI via a crafted payload...

Sql injection

An issue in the render function of beetl v3.15.0 allows attackers to execute server-side template injection SSTI via a crafted payload...

CVE-2023-30331

CVE-2023-30331 affects Beetl v3.15.0 where the render function is vulnerable to server-side template injection (SSTI). The root cause is insufficient checks in the render path, enabling a crafted payload to execute code on the server. The issue is rated CRITICAL (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U...

CVE-2023-29827

ejs v3.1.9 is vulnerable to server-side template injection. If the ejs file is controllable, template injection can be implemented through the configuration settings of the closeDelimiter parameter. NOTE: this is disputed by the vendor because the render function is not intended to be used with...

CVE-2023-29827

ejs v3.1.9 is vulnerable to server-side template injection. If the ejs file is controllable, template injection can be implemented through the configuration settings of the closeDelimiter parameter. NOTE: this is disputed by the vendor because the render function is not intended to be used with...

CVE-2023-30331

An issue in the render function of beetl v3.15.0 allows attackers to execute server-side template injection SSTI via a crafted payload...

CVE-2023-30331

An issue in the render function of beetl v3.15.0 allows attackers to execute server-side template injection SSTI via a crafted payload...

CVE-2023-29827: Improper Neutralization of Special Elements in Output Used by a Downstream Component

ejs v3.1.9 is vulnerable to server-side template injection. If the ejs file is controllable, template injection can be implemented through the configuration settings of the closeDelimiter parameter. NOTE: this is disputed by the vendor because the render function is not intended to be used with...

CVE-2023-30331: Undefined Security Weakness

An issue in the render function of beetl v3.15.0 allows attackers to execute server-side template injection SSTI via a crafted payload...