674 matches found
CVE-2021-44618
A Server-side Template Injection SSTI vulnerability exists in Nystudio107 Seomatic 3.4.12 in src/helpers/UrlHelper.php via the host header...
JetBrains YouTrack Server-Side Template Injection Vulnerability (CNVD-2022-17758)
JetBrains YouTrack is a browser-based bug tracking and project management software from JetBrains Czech Republic. JetBrains YouTrack is vulnerable to server-side template injection, which can be exploited by attackers to perform SSTI server-side template injection attacks...
CVE-2022-24442
JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI Server-Side Template Injection via FreeMarker templates...
CVE-2022-24442
JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI Server-Side Template Injection via FreeMarker templates...
CVE-2022-24442
JetBrains YouTrack (pre-2021.4.40426) is affected by SSTI via FreeMarker templates. The issue, CVE-2022-24442, allows server-side template injection and may enable remote code execution; the fix is to update to 2021.4.40426 or later. A public exploit PoC exists on GitHub outlining the RCE possibi...
CVE-2022-24442: Improper Control of Generation of Code
JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI Server-Side Template Injection via FreeMarker templates...
GitHub Security Lab: Java : Add query to detect Server Side Template Injection (SSTI)
This bug was reported directly to GitHub Security Lab...
iCMS Code Injection Vulnerability
iCMS is a software application. An efficient and simple content management system built with PHP and MySQL. iCMS suffers from a code injection vulnerability that stems from the fact that iCMS allows users to add and render comtom templates, which are SSTI-vulnerable. An attacker can exploit this...
Server Side Template Injection in MCMS
MCMS v5.2.5 was discovered to contain a Server Side Template Injection SSTI vulnerability via the Template Management module...
CVE-2021-46063
MCMS v5.2.5 was discovered to contain a Server Side Template Injection SSTI vulnerability via the Template Management module...
Sql injection
MCMS v5.2.5 was discovered to contain a Server Side Template Injection SSTI vulnerability via the Template Management module...
CVE-2021-46063
CVE-2021-46063 corresponds to a Server-Side Template Injection (SSTI) in MCMS v5.2.5, via the Template Management module. The issue is a SSTI vulnerability in MCMS 5.2.5 that can affect integrity and availability (per CVSS-3.1 base metrics: 9.1, CRITICAL) and is network-exploitable with low attac...
CVE-2021-46063
MCMS v5.2.5 was discovered to contain a Server Side Template Injection SSTI vulnerability via the Template Management module...
CVE-2021-46063: Improper Control of Generation of Code
MCMS v5.2.5 was discovered to contain a Server Side Template Injection SSTI vulnerability via the Template Management module...
CVE-2021-46362
A Server-Side Template Injection SSTI vulnerability in the Registration and Forgotten Password forms of Magnolia v6.2.3 and below allows attackers to execute arbitrary code via a crafted payload entered into the fullname parameter...
Sql injection
A Server-Side Template Injection SSTI vulnerability in the Registration and Forgotten Password forms of Magnolia v6.2.3 and below allows attackers to execute arbitrary code via a crafted payload entered into the fullname parameter...
CVE-2021-46362
A Server-Side Template Injection SSTI vulnerability in the Registration and Forgotten Password forms of Magnolia v6.2.3 and below allows attackers to execute arbitrary code via a crafted payload entered into the fullname parameter...
CVE-2021-46362
Magnolia CMS is affected by a Server-Side Template Injection (SSTI) in the Registration and Forgotten Password forms via the fullname parameter for Magnolia versions prior to 6.2.3. The root cause is SSTI that can allow arbitrary code execution, with high-severity impact (CVSS 3.1: CRITICAL, base...
CVE-2021-46362: Improper Control of Generation of Code
A Server-Side Template Injection SSTI vulnerability in the Registration and Forgotten Password forms of Magnolia v6.2.3 and below allows attackers to execute arbitrary code via a crafted payload entered into the fullname parameter...