UBUNTU-CVE-2019-8341

An issue was discovered in Jinja2 2.10. The fromstring function is prone to Server Side Template Injection SSTI where it takes the "source" parameter as a template object, renders it, and then returns it. The attacker can exploit it with INJECTION COMMANDS in a URI. NOTE: The maintainer and...

CVE-2019-8341

An issue was discovered in Jinja2 2.10. The fromstring function is prone to Server Side Template Injection SSTI where it takes the "source" parameter as a template object, renders it, and then returns it. The attacker can exploit it with INJECTION COMMANDS in a URI. NOTE: The maintainer and...

CVE-2019-8341

The CVE-2019-8341 issue affects Jinja2 2.10 where from_string treats the source as a template object, rendering it and returning the result, enabling Server-Side Template Injection via {{INJECTION COMMANDS}} in a URI. The vulnerability is described with contention over its validity, but multiple ...

CVE-2019-8341

An issue was discovered in Jinja2 2.10. The fromstring function is prone to Server Side Template Injection SSTI where it takes the "source" parameter as a template object, renders it, and then returns it. The attacker can exploit it with INJECTION COMMANDS in a URI. NOTE: The maintainer and...

Jinja2 2.10 - from_string Server Side Template Injection

Jinja2 2.10 - fromstring Server Side Template Injection ''' Exploit Title: Jinja2 Command injection fromstring function Date: date Exploit Author: JameelNabbo Website: Ordina.nl Vendor Homepage: http://jinja.pocoo.org Software Link: https://pypi.org/project/Jinja2/files Version: 2.10 Tested on:...

Code Injection

The fromstring function is prone to Server Side Template Injection SSTI where it takes the source parameter as a template object, renders it, and then returns it. The attacker can exploit it with INJECTION COMMANDS in a URI...

Jinja2 2.10 - 'from_string' Server Side Template Injection

''' Exploit Title: Jinja2 Command injection fromstring function Date: date Exploit Author: JameelNabbo Website: Ordina.nl Vendor Homepage: http://jinja.pocoo.org Software Link: https://pypi.org/project/Jinja2/files Version: 2.10 Tested on: Kali Linux CVE-2019-8341 // fromstring function is prone ...

PDF Signer 3.0 - Server-Side Template Injection leading to Remote Command Execution (via Cross-Site Request Forgery Cookie)

PDF Signer 3.0 - Server-Side Template Injection leading to Remote Command Execution via Cross-Site Request Forgery Cookie Exploit Title: PDF Signer v3.0 - SSTI to RCE via CSRF Cookie Dork: N/A Date: 2019-01-28 Exploit Author: dd [email protected] Vendor Homepage:...

PDF Signer 3.0 - SSTI to RCE via CSRF Cookie Vulnerability

Exploit for php platform in category web applications Exploit Title: PDF Signer v3.0 - SSTI to RCE via CSRF Cookie Exploit Author: dd email protected Vendor Homepage: https://codecanyon.net/user/simcycreative Software Link:...

PDF Signer 3.0 Template Injection / CSRF / Code Execution

Exploit Title: PDF Signer v3.0 - SSTI to RCE via CSRF Cookie Dork: N/A Date: 2019-01-28 Exploit Author: dd [email protected] Vendor Homepage: https://codecanyon.net/user/simcycreative Software Link:...

PDF Signer 3.0 - Server-Side Template Injection leading to Remote Command Execution (via Cross-Site Request Forgery Cookie)

Exploit Title: PDF Signer v3.0 - SSTI to RCE via CSRF Cookie Dork: N/A Date: 2019-01-28 Exploit Author: dd [email protected] Vendor Homepage: https://codecanyon.net/user/simcycreative Software Link:...

Craft CMS Server-Side Template Injection Vulnerability

Craft CMS is a content management system CMS for developers and content managers. A security vulnerability exists in Craft CMS 3.0.34 and prior versions. A remote attacker could exploit the vulnerability to read sensitive information...

CVE-2018-20465

Craft CMS through 3.0.34 allows remote authenticated administrators to read sensitive information via server-side template injection, as demonstrated by a % string for craft.app.config.DB.user and craft.app.config.DB.password in the URI Format of the Site Settings, which causes a cleartext userna...

CVE-2018-20465

Craft CMS 3.x up to version 3.0.34 is vulnerable to a Server-Side Template Injection (SSTI) that allows remote authenticated administrators to read sensitive configuration data. The flaw is demonstrated by injecting a template snippet that accesses craft.app.config.DB.user and craft.app.config.DB...

CVE-2018-20465

Craft CMS through 3.0.34 allows remote authenticated administrators to read sensitive information via server-side template injection, as demonstrated by a % string for craft.app.config.DB.user and craft.app.config.DB.password in the URI Format of the Site Settings, which causes a cleartext userna...

OS Command Injection in craftercms:crafter-studio

A Server-Side Template Injection issue was discovered in Crafter CMS 3.0.18. Attackers with developer privileges may execute OS commands by Creating/Editing a template file .ftl filetype that triggers a call to freemarker.template.utility.Execute in the FreeMarker library during rendering of a we...

GHSA-9FCP-VCQ9-9H2H OS Command Injection in craftercms:crafter-studio

A Server-Side Template Injection issue was discovered in Crafter CMS 3.0.18. Attackers with developer privileges may execute OS commands by Creating/Editing a template file .ftl filetype that triggers a call to freemarker.template.utility.Execute in the FreeMarker library during rendering of a we...

Sql injection

A Server-Side Template Injection issue was discovered in Crafter CMS 3.0.18. Attackers with developer privileges may execute OS commands by Creating/Editing a template file .ftl filetype that triggers a call to freemarker.template.utility.Execute in the FreeMarker library during rendering of a we...

CVE-2018-19907

A Server-Side Template Injection issue was discovered in Crafter CMS 3.0.18. Attackers with developer privileges may execute OS commands by Creating/Editing a template file .ftl filetype that triggers a call to freemarker.template.utility.Execute in the FreeMarker library during rendering of a we...

CVE-2018-19907

Crafter CMS 3.0.18 is affected by a Server-Side Template Injection vulnerability. Attackers with developer privileges can cause the FreeMarker library call freemarker.template.utility.Execute while rendering a webpage by creating/editing a template file (.ftl), leading to OS command execution. Th...