2590 matches found
CVE-2023-30145
Camaleon CMS v2.7.0 was discovered to contain a Server-Side Template Injection SSTI vulnerability via the formats parameter...
Server-Side Template Injection in Camaleon CMS
Camaleon CMS prior to 2.7.4 was discovered to contain a Server-Side Template Injection SSTI vulnerability via the formats parameter...
Exploit for Code Injection in Tuzitio Camaleon_Cms
Description: Camaleon CMS v2.7.0 was discovered to contain a S...
PT-2023-6903 · Ibm · Ibm Security Guardium Data Encryption +1
Name of the Vulnerable Software and Affected Versions: IBM Security Guardium Data Encryption IBM Guardium Cloud Key Manager GCKM version 1.10.3 Description: The issue is caused by an angular template injection flaw, allowing a remote attacker to execute arbitrary code on the system by sending a...
AZL-79022 CVE-2023-29400 affecting package golang 1.25.7-1
Templates containing actions in unquoted HTML attributes e.g. "attr=." executed with empty input can result in output with unexpected results when parsed due to HTML normalization rules. This may allow injection of arbitrary attributes into tags...
UBUNTU-CVE-2023-29400
Templates containing actions in unquoted HTML attributes e.g. "attr=." executed with empty input can result in output with unexpected results when parsed due to HTML normalization rules. This may allow injection of arbitrary attributes into tags...
CVE-2023-29400 Improper handling of empty HTML attributes in html/template
Templates containing actions in unquoted HTML attributes e.g. "attr=." executed with empty input can result in output with unexpected results when parsed due to HTML normalization rules. This may allow injection of arbitrary attributes into tags...
CVE-2023-29400
Templates containing actions in unquoted HTML attributes e.g. "attr=." executed with empty input can result in output with unexpected results when parsed due to HTML normalization rules. This may allow injection of arbitrary attributes into tags...
Server-Side Template Injection(SSTI)
com.ibeetl:beetl is vulnerable to Server-Side Template InjectionSSTI. A remote attacker is able to cause server-side template injection due to insufficient checks in render function via a crafted payload...
Pentaho Business Server Authentication Bypass / SSTI / Code Execution
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Pentaho Business Server Auth Bypass and Server Side Template Injection RCE', 'Description' = %q Hitachi Vantara Pentaho Business Analytics Server...
PT-2023-22983 · Monicahq · Monicahq
Name of the Vulnerable Software and Affected Versions: MonicaHQ version 4.0.0 Description: The issue allows an authenticated remote attacker to execute malicious code in the application via CSTI in the "people:id/relationships" endpoint, specifically using the first name and last name parameters...
CVE-2023-29827
ejs v3.1.9 is vulnerable to server-side template injection. If the ejs file is controllable, template injection can be implemented through the configuration settings of the closeDelimiter parameter. NOTE: this is disputed by the vendor because the render function is not intended to be used with...
CVE-2023-29827
ejs v3.1.9 is vulnerable to server-side template injection. If the ejs file is controllable, template injection can be implemented through the configuration settings of the closeDelimiter parameter. NOTE: this is disputed by the vendor because the render function is not intended to be used with...
CVE-2023-29827
ejs v3.1.9 is vulnerable to server-side template injection. If the ejs file is controllable, template injection can be implemented through the configuration settings of the closeDelimiter parameter. NOTE: this is disputed by the vendor because the render function is not intended to be used with...
Input validation
DISPUTED ejs v3.1.9 is vulnerable to server-side template injection. If the ejs file is controllable, template injection can be implemented through the configuration settings of the closeDelimiter parameter. NOTE: this is disputed by the vendor because the render function is not intended to be us...
Server-side template injection in beetl
An issue in the render function of beetl v3.15.0 allows attackers to execute server-side template injection SSTI via a crafted payload...
GHSA-M69H-4FRQ-VWQ7 Server-side template injection in beetl
An issue in the render function of beetl v3.15.0 allows attackers to execute server-side template injection SSTI via a crafted payload...
CVE-2023-30331
An issue in the render function of beetl v3.15.0 allows attackers to execute server-side template injection SSTI via a crafted payload...