CVE-2026-104073

NetBox versions 2.9.5 before 4.7.0 are vulnerable to a server-side template injection vulnerability. A low-privileged user with the "Can add custom links" permission can exploit this by exposing the raw Django HttpRequest object to the Jinja2 template context. An attacker can craft a custom link ...

CVE-2024-4040-SSTI-LFI-PoC

CVE-2024-4040 SSTI & LFI PoC - Exploitation | CrushFTP This is a proof of concept for a Server Side Template Injection SSTI & Local File Inclusion LFI vulnerability in CrushFTP. Features Taking leverage of Critical Severity Vulnerabilities in CrushFTP servers through Server Side Template Injectio...

CVE-2024-31982

CVE-2024-31982 Java SSTI - Lead to RCE async async=falsegroovyprintln"Successful Injection"/groovy/ GET /bin/get/Main/DatabaseSearch?outputSyntax=plain&text=%7D%7D%7D%7B%7Basync%20async%3Dfalse%7D%7D%7B%7Bgroovy%7D%7Dprintln%28%22Successful%20Injection%22%29%7B%7B%2Fgroovy%7D%7D%7B%7B%2F HTTP/1.1...

SSTImap

SSTImap This project is based on Tplmap. SSTImap is a penetration testing software that can check websites for Code Injection and Server-Side Template Injection vulnerabilities and exploit them, giving access to the operating system itself. This tool was developed to be used as an interactive...

CVE-2022-25813

CVE-2022-25813: FreeMarker Server-Side Template Injection in Apache OfBiz By inserting malicious content in a message’s “Subject” field, an attacker may perform SSTI Server-Side Template Injection attacks, which can leverage FreeMarker exposed objects to bypass restrictions and obtain RCE Remote...

CVE-2023-30145

Description: Camaleon CMS v2.7.0 was discovered to contain a Server-Side Template Injection SSTI vulnerability via the formats parameter. Affected Component: All versions that are below 2.7.0 Fixed version: Fixed Versions: 2.7.4 Step to reproduce : Detection: 1.open below...

CVE-2025-52122

CVE CraftCMS Freeform CraftCMS Freeform contiene una vulnerabilidad SSTI, que resulta en una inyección de código arbitrario para todos los usuarios que tienen acceso a editar un formulario título de envío. Las versiones vulnerables son v5.0.0 test % set form = freeform.form'pentest' % % if form %...

GenGravSSTIExploit

EN GenGravSSTIExploit is a PoC Python script that exploits an authenticated Server-Side Template Injection SSTI vulnerability in Grav CMS versions -p : Target URL in the format https://hostname. : Port number default is 80. Example: python GenGravSSTIExploit.py -t http://example.com -p 8080 4...

GenCrushSSTIExploit

EN GenCrushSSTIExploit is a PoC exploit tool targeting the SSTI Server-Side Template Injection vulnerability in CrushFTP CVE-2024-4040. This tool demonstrates how to exploit this vulnerability for educational and ethical hacking purposes only. Features Establishes a session with the CrushFTP serv...

CVE-2021-26121

CS-Cart templates.manage Server Side Template Injection Remote Code Execution Vulnerability Found by: Steven Seeley of 360 Vulcan Team Version: = 4.12.x latest Date: 2021-01-08 12:49 CVE: CVE-2021-26121 Disclosure Timeline 2021-01-26 – Sent to CSCart dev team 2021-01-27 – Notification of reciept...

VMware-CVE-2022-22954

VMware CVE-2022-22954 Workspace ONE Access Freemarker Server-side Template Injection POC for Vmware CVE-2022-22954 Use this one line GET request!! This will execute cat /etc/passwd...

CVE-2023-49964

CVE-2023-49964: FreeMarker Server-Side Template Injection in Alfresco An issue was discovered in Hyland Alfresco Community Edition =7.2.0. By inserting malicious content in the folder.get.html.ftl file, an attacker may perform SSTI Server-Side Template Injection attacks, which can leverage...

CVE-2025-24893-RCE-PoC

Infos This PoC first tests for the SSTI and if it works. It will go in loop and allows you to run commands remotly. The exec and shell command do the same currently. Installation python3 -m pip install requirements.txt Usage Connecting python3 poc.py Example With debug set to False default python...

CVE-2022-22954_VMware_PoC

CVE-2022-22954 PoC - VMware Workspace ONE Access Freemarker Server-Side Template Injection A vulnerability, which was classified as very critical, was found in Vmware Workspace ONE Access and Identity Manager. Affected component is Template Handler. Reference: https://vuldb.com/?id.196644 Usage:...

CVE-2025-24893

XWiki SSTI Exploit A Python exploit for XWiki Server-Side Template Injection SSTI vulnerability via Groovy template injection in the SolrSearch endpoint. Vulnerability Type : Server-Side Template Injection SSTI Component : XWiki SolrSearch RSS feed Impact : Remote Code Execution Affected Version ...

CVE-2024-4040

CVE-2024-4040 A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform...

tplmap

Tplmap Este proyecto ya no recibe mantenimiento. Estaré encantado de fusionar nuevos PRs siempre que no rompan el conjunto de pruebas. Tplmap ayuda en la explotación de vulnerabilidades de Inyección de Código e Inyección de Plantillas del Lado del Servidor SSTI mediante diversas técnicas de escap...

exploit-CVE-2022-24780

iTop RCE via SSTI - exploit CVE-2022-24780 iTop --debug exploit.rb light --debug exploit.rb -h | --help full: exploit with an emulated browser, execute JavaScript, preserve original user profile information light: just parse HTML and send requests, no JavaScript, DESTRUCTIVE reset user informatio...

CVE-2022-24086

CVE-2022-24086 Tested with: magento 2.4.3 and sample data Docker image: docker.io/bitnami/magento:2.4.3-debian-10-r0 First Name: var this.getTemplateFilter.filter$order.shippingaddress.cityvar...

CVE-2026-38165-SSTI-

CVE-2026-38165 SSTI Velocity Inyección de Plantillas del Lado del Servidor SSTI en XDocReport permite Ejecución Remota de Código a través del motor Apache Velocity Definición del error Resumen de la vulnerabilidad Server-Side Template Injection SSTI es una vulnerabilidad de seguridad web que...