927 matches found
EUVD-2025-200111
Grav is Vulnerable to Security Sandbox Bypass with SSTI Server Side Template Injection...
Grav is Vulnerable to Security Sandbox Bypass with SSTI (Server Side Template Injection)
Summary Grav CMS is vulnerable to a Server-Side Template Injection SSTI that allows any authenticated user with editor permissions to execute arbitrary code on the remote server, bypassing the existing security sandbox. Details Grav CMS uses a custom sandbox to protect the powerful Twig methods...
CVE-2025-66299
Grav CMS is vulnerable to a Server-Side Template Injection (SSTI) that lets an authenticated editor execute arbitrary code on the server by abusing the Twig sandbox, bypassing restrictions via crafted Twig directives to modify system.twig.safe_filters. The issue exists prior to Grav 1.8.0-beta.27...
CVE-2025-66298 Grav is vulnerable to Server-Side Template Injection (SSTI) via Forms
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, having a simple form on site can reveal the whole Grav configuration details including plugin configuration details by using the correct POST payload to exploit a Server-Side Template SST vulnerability. Sensitive information may be...
CVE-2025-66294
CVE-2025-66294 affects Grav CMS. A Server-Side Template Injection (SSTI) exists due to weak regex validation in the core method cleanDangerousTwig, enabling an authenticated editor to trigger arbitrary commands on the server; in some cases, unauthenticated exploitation is possible. Public materia...
Grav CMS Twig SSTI Authenticated Sandbox Bypass RCE
This module exploits a Server-Side Template Injection SSTI vulnerability CVE-2025-66294 in Grav CMS that allows bypassing the Twig sandbox to achieve remote code execution. The cleanDangerousTwig method uses weak regex that fails to sanitize nested Twig calls within the evaluatetwig function. To...
Exploit for CVE-2025-64087
CVE-2025-64087 SSTI FreeMarker Server-Side Template Injec...
Server-Side Template Injection
github.com/lxc/lxd is vulnerable to Server-Side Template Injection SSTI. The vulnerability is due to improper handling of snapshot pattern templates using the Pongo2 template engine, which allows an attacker with instance-configuration permissions to craft malicious templates and read arbitrary...
GHSA-527Q-4WQV-G9WJ bagisto has Server Side Template Injection (SSTI) in Product Description
Summary Bagisto v2.3.7 is vulnerable to Server-Side Template Injection SSTI due to unsanitized user input being processed by the server-side templating engine when rendering product descriptions. This allows an attacker with product creation privileges to inject arbitrary template expressions tha...
EUVD-2019-10958
Malware in sbrugna...
EUVD-2020-0435
Malware in sbrugna...
EUVD-2019-6057
Malware in sbrugna...
EUVD-2021-22092
Malware in sbrugna...
EUVD-2020-0549
Malware in sbrugna...
EUVD-2020-18597
Malware in sbrugna...
EUVD-2020-0372
Malware in sbrugna...
EUVD-2021-1261
Malware in sbrugna...
EUVD-2021-0204
Malware in sbrugna...