2782 matches found
LaRecipe is vulnerable to Server-Side Template Injection attacks
Impact Attackers could: 1. Execute arbitrary commands on the server 2. Access sensitive environment variables 3. Escalate access depending on server configuration A critical vulnerability was discovered in LaRecipe that allows an attacker to perform Server-Side Template Injection SSTI, potentiall...
GHSA-JV7X-XHV2-P5V2 LaRecipe is vulnerable to Server-Side Template Injection attacks
Impact Attackers could: 1. Execute arbitrary commands on the server 2. Access sensitive environment variables 3. Escalate access depending on server configuration A critical vulnerability was discovered in LaRecipe that allows an attacker to perform Server-Side Template Injection SSTI, potentiall...
LaRecipe 安全漏洞
LaRecipe is a software by Saleem Hadad سليم حداد individual developer that uses MarkDown to write and publish documentation for Laravel applications. A security vulnerability exists in LaRecipe versions prior to 2.8.1 that stems from server-side template injection and could lead to remote code...
PT-2025-29522
Name of the Vulnerable Software and Affected Versions: LaRecipe versions prior to 2.8.1 Description: LaRecipe is an application that allows users to create documentation with Markdown inside a Laravel app. Versions prior to 2.8.1 are vulnerable to Server-Side Template Injection SSTI, which could...
XWiki Platform SolrSearch Macro Remote Code Execution
XWiki Platform versions from 5.3-milestone-2 before 15.10.11 and from 16.0.0-rc-1 before 16.4.1 suffer from a Server-Side Template Injection SSTI due to the lack of sanitization of the SolrSearch Macro requests. By leveraging this vulnerability, a remote and unauthenticated attacker can achieve...
📄 Tiki Wiki CMS Groupware 28.3 Server-Side Template Injection
Tiki Wiki CMS Groupware versions 28.3 and below suffer from two server-side template injection vulnerabilities via specially crafted wiki pages. ---------------------------------------------------------------------------------- Tiki Wiki CMS Groupware '" The second vulnerability can be leveraged ...
CVE-2025-49521 Event-driven-ansible: template injection via git branch and refspec in eda projects
A flaw was found in the EDA component of the Ansible Automation Platform, where user-supplied Git branch or refspec values are evaluated as Jinja2 templates. This vulnerability allows authenticated users to inject expressions that execute commands or access sensitive files on the EDA worker. In...
CVE-2025-49521 Event-driven-ansible: template injection via git branch and refspec in eda projects
A flaw was found in the EDA component of the Ansible Automation Platform, where user-supplied Git branch or refspec values are evaluated as Jinja2 templates. This vulnerability allows authenticated users to inject expressions that execute commands or access sensitive files on the EDA worker. In...
CVE-2025-49521
CVE-2025-49521 affects the EDA component of Red Hat Ansible Automation Platform. The issue is template injection via user-provided Git branch or refspec values, allowing authenticated users to inject expressions that execute commands or read sensitive files on the EDA worker; in OpenShift this ca...
Template Injection
PySpur is vulnerable to Template Injection. The vulnerability is due to improper neutralization of special elements due to unsafe handling of the usermessage argument in the SingleLLMCallNode function of the Jinja2 Template Handler component...
Kingdee Cloud-Starry-Sky Enterprise Edition 安全漏洞
Kingdee Cloud-Starry-Sky Enterprise Edition is a digital transformation solution for growing enterprises from Kingdee, China. A security vulnerability exists in Kingdee Cloud-Starry-Sky Enterprise Edition version 6.x, 7.x, 8.x, and 9.0, which stems from improper neutralization of template element...
[SECURITY] [DLA 4224-1] node-send security update
------------------------------------------------------------------------- Debian LTS Advisory DLA-4224-1 [email protected] https://www.debian.org/lts/security/ Adrian Bunk June 23, 2025 https://wiki.debian.org/LTS -...
Debian dla-4224 : node-send - security update
The remote Debian 11 host has a package installed that is affected by a vulnerability as referenced in the dla-4224 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4224-1 [email protected] https://www.debian.org/lts/security/...
OESA-2025-1647 ansible security update
\ Security Fixes: A flaw was found in Ansible, where a user's controller is vulnerable to template injection. This issue can occur through facts used in the template if the user is trying to put templates in multi-line YAML strings and the facts being handled do not routinely include special...
BeyondTrust Remote Support (RS) 24.2.2 < 24.3.3 Server-Side Template Injection
The version of BeyondTrust Remote Support RS running on the remote host is affected by a server-side template injection vulnerability which can lead to remote code execution. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version...
CVE-2025-5309
The chat feature within Remote Support RS and Privileged Remote Access PRA is vulnerable to a Server-Side Template Injection vulnerability which can lead to remote code execution...
📄 Skyvern 0.1.85 Remtoe Code Execution / SSTI
Skyvern version 0.1.85 suffers from a remote code execution vulnerability via server-side template injection. Exploit Title: Skyvern 0.1.85 - Remote Code Execution RCE via SSTI Date: 2025-06-15 Exploit Author: Cristian Branet Vendor Homepage: https://www.skyvern.com/ Software Link:...
CVE-2025-5309
The chat feature within Remote Support RS and Privileged Remote Access PRA is vulnerable to a Server-Side Template Injection vulnerability which can lead to remote code execution...
