1183 matches found
PT-2024-27131
Name of the Vulnerable Software and Affected Versions OpenCart version 4.0.2.3 Description The issue is related to a Server-Side Template Injection SSTI vulnerability via the Theme Editor Function. This allows attackers to execute arbitrary code by injecting a crafted payload. Recommendations For...
PT-2024-4769 · Apache · Apache Airflow
Name of the Vulnerable Software and Affected Versions: Apache Airflow versions 2.4.0 through 2.9.3 Description: This vulnerability allows authenticated DAG authors to craft a malicious doc md parameter, potentially leading to arbitrary code execution within the scheduler context. This bypasses...
Server-Side Template Injection
airbyte is vulnerable to Server-Side Template Injection. The vulnerability is due to improper handling of user input in the connection builder, allowing attackers to execute arbitrary code on the server...
CVE-2024-38363 Remote Code Execution (RCE) via Server Side Template Injection (SSTI) in Airbyte
Airbyte is a data integration platform for ELT pipelines. Airbyte connection builder docker image is vulnerable to RCE via SSTI which allows an authenticated remote attacker to execute arbitrary code on the server as the web server user. The connection builder is used to create and test new...
CVE-2024-37621
StrongShop v1.0 was discovered to contain a Server-Side Template Injection SSTI vulnerability via the component /shippingOptionConfig/index.blade.php...
CVE-2024-37621
StrongShop v1.0 is vulnerable to a Server-Side Template Injection (SSTI) vulnerability within the /shippingOptionConfig/index.blade.php component. This flaw is associated with CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine) and CWE-97 (Improper Neutralization of S...
CVE-2024-37621
StrongShop v1.0 was discovered to contain a Server-Side Template Injection SSTI vulnerability via the component /shippingOptionConfig/index.blade.php...
CVE-2024-37621: Improper Neutralization of Server-Side Includes (SSI) Within a Web Page
StrongShop v1.0 was discovered to contain a Server-Side Template Injection SSTI vulnerability via the component /shippingOptionConfig/index.blade.php...
CVE-2024-37621
StrongShop v1.0 was discovered to contain a Server-Side Template Injection SSTI vulnerability via the component /shippingOptionConfig/index.blade.php...
Exploit for Code Injection in Rejetto Http_File_Server
Rejetto HFS HTTP File Server CVE-2024-23692 Vulnerability...
Server-side Template Injection (SSTI)
documentmergeservice is vulnerable to Server-side Template Injection SSTI. The vulnerability is due to insufficient input sanitization and validation in the handling of templates within the Document Merge Service, which allows attackers to inject malicious code into templates, which is then...
Rejetto HTTP File Server (HFS) Unauthenticated Remote Code Execution Exploit
The Rejetto HTTP File Server HFS version 2.x is vulnerable to an unauthenticated server side template injection SSTI vulnerability. A remote unauthenticated attacker can execute code with the privileges of the user account running the HFS.exe server process. This exploit has been tested to work...
document-merge-service vulnerable to Remote Code Execution via Server-Side Template Injection
Impact What kind of vulnerability is it? Who is impacted? A remote code execution RCE via server-side template injection SSTI allows for user supplied code to be executed in the server's context where it is executed as the document-merge-server user with the UID 901 thus giving an attacker...
CVE-2024-37301
Document Merge Service is a document template merge service providing an API to manage templates and merge them with given data. Versions 6.5.1 and prior are vulnerable to remote code execution via server-side template injection which, when executed as root, can result in full takeover of the...
CVE-2024-37301 document-merge-service vulnerable to Remote Code Execution via Server-Side Template Injection
Document Merge Service is a document template merge service providing an API to manage templates and merge them with given data. Versions 6.5.1 and prior are vulnerable to remote code execution via server-side template injection which, when executed as root, can result in full takeover of the...
CVE-2024-37301: Improper Neutralization of Special Elements Used in a Template Engine
Document Merge Service is a document template merge service providing an API to manage templates and merge them with given data. Versions 6.5.1 and prior are vulnerable to remote code execution via server-side template injection which, when executed as root, can result in full takeover of the...
Akaunting 3.1.8 - Server-Side Template Injection (SSTI) Vulnerability
Exploit Title: Akaunting 3.1.8 - Server-Side Template Injection SSTI Exploit Author: tmrswrr Vendor: https://akaunting.com/forum Software Link: https://akaunting.com/apps/crm Vulnerable Versions: 3.1.8 Tested : https://www.softaculous.com/apps/erp/Akaunting 1 Login with admin cred and go to : Ite...
Akaunting 3.1.8 - Server-Side Template Injection (SSTI)
Exploit Title: Akaunting 3.1.8 - Server-Side Template Injection SSTI Exploit Author: tmrswrr Date: 30/05/2024 Vendor: https://akaunting.com/forum Software Link: https://akaunting.com/apps/crm Vulnerable Versions: 3.1.8 Tested : https://www.softaculous.com/apps/erp/Akaunting 1 Login with admin cre...
Akaunting 3.1.8 Server-Side Template Injection
Exploit Title: Akaunting 3.1.8 - Server-Side Template Injection SSTI Exploit Author: tmrswrr Date: 30/05/2024 Vendor: https://akaunting.com/forum Software Link: https://akaunting.com/apps/crm Vulnerable Versions: 3.1.8 Tested : https://www.softaculous.com/apps/erp/Akaunting 1 Login with admin cre...