PT-2024-32961

Name of the Vulnerable Software and Affected Versions Supsystic Contact Form versions 1.7.28 and earlier Description The issue is related to an Improper Neutralization of Special Elements Used in a Template Engine vulnerability, which allows Command Injection. This can lead to potential cyber...

PT-2024-33410 · Elementor · Unlimited Elements For Elementor

Name of the Vulnerable Software and Affected Versions: Unlimited Elements For Elementor versions 1.5.121 and earlier Description: The issue is related to an Improper Neutralization of Special Elements Used in a Template Engine, which allows Command Injection. This means that an attacker could...

changedetection.io has a Server Side Template Injection using Jinja2 which allows Remote Command Execution

Summary A Server Side Template Injection in changedetection.io caused by usage of unsafe functions of Jinja2 allows Remote Command Execution on the server host. Details changedetection.io version: 0.45.20 docker images REPOSITORY TAG IMAGE ID CREATED SIZE dgtlmoon/changedetection.io latest...

Exploit for Code Injection in Sqlpad

CVE-2022-0944 PoC PoC for RCE in SQLPad. This example spawns a...

Debian dsa-5771 : php-twig - security update

The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5771 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-5771-1 [email protected] https://www.debian.org/security/ Moritz...

Exploit for Code Injection in Sqlpad

SQLPad RCE Exploit This repository contains an exploit script...

Exploit for Code Injection in Sqlpad

I am not the researcher w...

Twig 安全漏洞

Twig is a PHP template engine open-sourced by Twig. A security vulnerability exists in Twig that stems from the fact that sandbox security checks will not be run under certain circumstances, allowing user-contributed templates to bypass sandbox restrictions...

Exploit for Code Injection in Sqlpad

CVE-2022-0944 A proof of concept exploit for SQLPad RCE CVE...

PT-2024-23330 · Allegra · Allegra

Name of the Vulnerable Software and Affected Versions: Allegra affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations of Allegra. Authentication is required to exploit this issue. The specific flaw exists within the...

python-jinja2 security update

An update is available for python-jinja2. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The python-jinja2 package contains Jinja2, a template engine written in...

Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine Vulnerability

Rejetto HTTP File Server contains an improper neutralization of special elements used in a template engine vulnerability. This allows a remote, unauthenticated attacker to execute commands on the affected system by sending a specially crafted HTTP request...

RHEL 8 : python-jinja2 (RHSA-2024:4231)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:4231 advisory. The python-jinja2 package contains Jinja2, a template engine written in pure Python. Jinja2 provides a Django inspired non-XML syntax but supports...

Medium: ansible-core

Issue Overview: Jinja is an extensible templating engine. The xmlattr filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, /, , or =, as each would then be interpreted as starting a separate attribute. If an application...

VulnCheck KEV: CVE-2024-23692

Rejetto HTTP File Server contains an improper neutralization of special elements used in a template engine vulnerability. This allows a remote, unauthenticated attacker to execute commands on the affected system by sending a specially crafted HTTP request...

Malicious code in @fnt-cmd/template-engine (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-3090 Malicious code in @fnt-cmd/template-engine (npm)

--- -= Per source details. Do not edit below this line.=-...

PaperCut MF EmailRenderer Server-Side Template Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of PaperCut MF. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the EmailRenderer class. The iss...

RLSA-2024:3102 Moderate: python-jinja2 security update

The python-jinja2 package contains Jinja2, a template engine written in pure Python. Jinja2 provides a Django inspired non-XML syntax but supports inline expressions and an optional sandboxed environment. Security Fixes: jinja2: HTML attribute injection when passing user input as keys to xmlattr...

CVE-2024-37166

ghtml is software that uses tagged templates for template engine functionality. It is possible to introduce user-controlled JavaScript code and trigger a Cross-Site Scripting XSS vulnerability in some cases. Version 2.0.0 introduces changes to mitigate this issue. Version 2.0.0 contains updated...