430 matches found
CVE-2024-27623
CMS Made Simple version 2.2.19 is vulnerable to Server-Side Template Injection SSTI. The vulnerability exists within the Design Manager, particularly when editing the Breadcrumbs...
CVE-2024-27623
CMS Made Simple version 2.2.19 is vulnerable to Server-Side Template Injection SSTI. The vulnerability exists within the Design Manager, particularly when editing the Breadcrumbs...
CVE-2024-27623
CMS Made Simple 2.2.19 is affected by CVE-2024-27623, a Server-Side Template Injection in the Design Manager component, specifically when editing Breadcrumbs. Red Hat’s entry confirms the vulnerability in CMSMS 2.2.19 and does not provide an official remediation in the cited materials. The availa...
GHSA-V4CP-2Q7V-HG9Q livehelperchat Server-Side Template Injection
Server-Side Template Injection SSTI vulnerability in livehelperchat before 4.34, allows remote attackers to execute arbitrary code and obtain sensitive information via the search parameter in lhcweb/modules/lhfaq/faqweight.php...
CVE-2024-27516
Server-Side Template Injection SSTI vulnerability in livehelperchat before 4.34v, allows remote attackers to execute arbitrary code and obtain sensitive information via the search parameter in lhcweb/modules/lhfaq/faqweight.php...
CVE-2024-27516
Server-Side Template Injection SSTI vulnerability in livehelperchat before 4.34v, allows remote attackers to execute arbitrary code and obtain sensitive information via the search parameter in lhcweb/modules/lhfaq/faqweight.php...
CVE-2024-27516
CVE-2024-27516 affects livehelperchat prior to version 4.34. The SSTI exists in the search parameter of lhc_web/modules/lhfaq/faqweight.php, enabling remote code execution and access to sensitive data. Impact is high (as per sources) including arbitrary code execution and data disclosure. Recomme...
CMS Made Simple 2.2.19 Server-Side Template Injection Vulnerability
Exploit Title: CMS Made Simple Version: 2.2.19 - SSTI Exploit Author: tmrswrr Vendor Homepage: https://www.cmsmadesimple.org/ Version: 2.2.19 Tested on: https://www.softaculous.com/demos/CMSMadeSimple 1 log in as admin and go to Layout Design Manager Breadcrumbs 2 Click edit and write SSTI payloa...
Beetl Server-Side Template Injection vulnerability
Before Beetl v3.15.13.RELEASE, the rendering template has a server-side template injection SSTI vulnerability. When the incoming template is controllable, it will be filtered by the DefaultNativeSecurityManager blacklist. Because blacklist filtering is not strict, the blacklist can be bypassed,...
GHSA-9GH8-877R-G477 Beetl Server-Side Template Injection vulnerability
Before Beetl v3.15.13.RELEASE, the rendering template has a server-side template injection SSTI vulnerability. When the incoming template is controllable, it will be filtered by the DefaultNativeSecurityManager blacklist. Because blacklist filtering is not strict, the blacklist can be bypassed,...
Sql injection
Before Beetl v3.15.12, the rendering template has a server-side template injection SSTI vulnerability. When the incoming template is controllable, it will be filtered by the DefaultNativeSecurityManager blacklist. Because blacklist filtering is not strict, the blacklist can be bypassed, leading t...
CVE-2024-22533
Beetl SSTI in versions prior to 3.15.12: the rendering template can be controlled, and the DefaultNativeSecurityManager blacklist is bypassable, enabling arbitrary code execution. Public sources (CVE-2024-22533 and related advisories) confirm the flaw exists in Beetl up to 3.15.11 and is exploita...
Server-Side Template Injection Vulnerability in Confluence Data Center and Server (CVE-2023-22527)
Introduction On January 16 2024, Atlassian issued a significant alert on a critical Server-Side Template Injection SSTI vulnerability in Confluence Data Center and Server, identified as CVE-2023-22527. This issue found in older versions, poses a serious risk as it allows attackers without any...
Atlassian Confluence SSTI Injection Exploit
This Metasploit module exploits an SSTI injection in Atlassian Confluence servers. A specially crafted HTTP request uses the injection to evaluate an OGNL expression resulting in OS command execution. Versions 8.5.0 through 8.5.3 and 8.0 to 8.4 are known to be vulnerable. This module requires...
Atlassian Confluence SSTI Injection
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Atlassian Confluence SSTI Injection', 'Description' = %q This module exploits an SSTI injection in Atlassian Confluence servers. A specially...
Exploit for Injection in Atlassian Confluence_Data_Center
CVE-2023-22527 Confluence RCE CVE-2023-22527 - RCE Remote Co...
Atlassian Confluence SSTI Injection
This module exploits an SSTI injection in Atlassian Confluence servers. A specially crafted HTTP request uses the injection to evaluate an OGNL expression resulting in OS command execution. Versions 8.5.0 through 8.5.3 and 8.0 to 8.4 are known to be vulnerable. Module Options msf use...
Remote Code Execution
jeecg-boot is vulnerable to SSTI Injection. The vulnerability is caused due to improper request verification within the jmreport/loadTableData component. This could allows remote attackers to execute arbitrary code via crafted HTTP requests...
JeecgBoot server-side template injection
SSTI injection vulnerability in jeecg-boot version 3.5.3, allows remote attackers to execute arbitrary code via crafted HTTP request to the /jmreport/loadTableData component...