CVE-2021-46703

CVE-2021-46703 Simple payload builder based on POC in: https://github.com/Antaris/RazorEngine/issues/585 Usage C dotnet build --configuration Release .\bin\Release\net4.8\Poc.exe "System.IO.File.WriteAllText"rce.txt", "Hello World";" Python ./poc.py "System.IO.File.WriteAllText"rce.txt",...

Exploit for Insecure Default Initialization of Resource in Apache Solr

CVE-2026-44825 — Apache Solr 기본 자격 증명 + Velocity Template RCE...

EUVD-2026-98043

Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a server-side template injection vulnerability because user-controlled message fields are not validated before template rendering, allowing expressions to run in an unrestricted context. Authenticated attackers holding a common...

CVE-2026-109652

Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a server-side template injection vulnerability because user-controlled message fields are not validated before template rendering, allowing expressions to run in an unrestricted context. Authenticated attackers holding a common...

CVE-2026-109652

Frappe ERPNext versions before 15.119.1 and 16.x before 16.32.0 are vulnerable to a Server-Side Template Injection (SSTI) . The root cause is a lack of validation on user-controlled message fields prior to template rendering, enabling the execution of expressions in an unrestricted context. Authe...

CVE-2026-103528

Thelia 2.6.0 uses Smarty for email templates without properly restricting access to dangerous PHP functions. An authenticated administrator can inject malicious Smarty expressions into email templates via the messages configuration interface, and when the template is previewed or rendered,...

Multiple vulnerabilities in Thelia 2.6.0 and 2.6.1

Overview Thelia versions 2.6.0 and 2.6.1 contain multiple vulnerabilities relating to file management, Smarty templating, module installation, and administrative workflows. Successful exploitation of these issues could enable remote code execution RCE, server-side template injection SSTI, stored...

CVE-2026-109652: Improper Neutralization of Special Elements Used in a Template Engine

Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a server-side template injection vulnerability because user-controlled message fields are not validated before template rendering, allowing expressions to run in an unrestricted context. Authenticated attackers holding a common...

tplmap

Tplmap Este proyecto ya no recibe mantenimiento. Estaré encantado de fusionar nuevos PRs siempre que no rompan el conjunto de pruebas. Tplmap ayuda en la explotación de vulnerabilidades de Inyección de Código e Inyección de Plantillas del Lado del Servidor SSTI mediante diversas técnicas de escap...

doctrack

Doctrack Herramienta para manipular y armamentizar documentos Office Open XML. Características Crear documentos Office Open XML Word, Excel Insertar píxeles de seguimiento y rutas UNC Inyección de plantilla remota Insertar partes CustomXML Inspeccionar URLs de destino externas, metadatos y partes...

CVE-2026-11104-Python-SSTI-via-Jinja2-attr-Filter-Bypass

CVE-2026-11104 – Python SSTI via Jinja2 |attr Filter Bypass Program Code Flask vulnerableapp.py - Flask with Jinja2 SSTI via 'attr' filter from flask import Flask, request, rendertemplatestring app = Flaskname @app.route'/' def index: name = request.args.get'name', 'World' UNSAFE: directly render...

Server-Side Template Injection

Handlebars is vulnerable to Server-Side Template Injection SSTI. The vulnerability is due to improper enforcement of prototype-access restrictions in lookupProperty, which allows an attacker to bypass the deny list, access the Function constructor through a controlled template, and execute...

openSUSE 16 Security Update : python-fsspec (openSUSE-SU-2026:22028-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:22028-1 advisory. Changes in python-fsspec: - CVE-2026-104851: python-fsspec: remote code execution via server-side template injection in ReferenceFileSystem bsc1284173...

DRUPAL-CONTRIB-2026-203

The Inline Formatter Field module allows site builders to template and style entities with a field. This module does not properly protect against template injection when parsing, allowing users to render protected data or execute unsafe Twig commands...

CVE-2026-104073

A flaw was found in NetBox. An authenticated user with permission to create custom links can exploit a template injection vulnerability to access sensitive session information and Application Programming Interface API tokens. When a victim views an object containing the malicious link, their...

Linked Field - Moderately critical - Server-side template injection - SA-CONTRIB-2026-200

This module enables you to link the output of a field to a URL or to the value of another field. The module doesn't sufficiently separate field content from template code when rendering linked field output. Depending on the Twig extensions installed on the site, this can be used to expose site...

Inline Formatter Field - Moderately critical - Server-side template injection - SA-CONTRIB-2026-203

The Inline Formatter Field module allows site builders to template and style entities with a field. This module does not properly protect against template injection when parsing, allowing users to render protected data or execute unsafe Twig commands...

PT-2026-107755

The Inline Formatter Field module allows site builders to template and style entities with a field. This module does not properly protect against template injection when parsing, allowing users to render protected data or execute unsafe Twig commands...

Security update for python-fsspec (important)

openSUSE security update: security update for python-fsspec ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22028-1 Rating: important References: bsc1284173 Cross-References: CVE-2026-104851 Affected Products: openSUSE Leap 16.0...

CVE-2026-104073

NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can add custom links" permission to steal session cookies and API tokens of other users by exposing the raw Django HttpRequest object to the Jinja2 template contex...