CVE-2021-32819

CVE-2021-32819 CVE-2021-32819 : SquirrellyJS mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuration options, remote code execution may be triggered in downstream applications. Source...

CVE-2026-75650

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-75650 Write-up: https://abraxaslabs.tech/research/CVE-2026-75650 CVE-2026-75650 Magento Open Source 2.4.8-p5 - Adobe I am @abraxasnull. Loopback lab. The client is CVE-2026-75650-Abraxas-Labs.py...

Nodejs Squirrelly - Remote Code Execution

Nodejs Squirrelly is susceptible to remote code execution. Squirrelly is a template engine implemented in JavaScript that works out of the box with ExpressJS. Squirrelly mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuratio...

PoC-CVE-2024-33883

CVE-2024-33883 [email protected], Insufficient Prototype Pollution Validation Leading to RCE Exploitation With prototype pollution, set opts.client to truthy value condition Then, when render runs, ejs will run opts.escapeFunction value as JS code. Vulnerable Code Range Based on...

CVE-2026-82531

CVE-2026-82531 — Smarty cache-poisoning RCE PoC Python 3 PoC for CVE-2026-82531 — smarty-php/smarty — code injection CWE-94 via forged SmartyNocache markers in extends + template cache regeneration → RCE on cacheinclude. Field| Value ---|--- CVE| CVE-2026-82531 Product| Smarty PHP template engine...

EUVD-2026-123869

A improper neutralization of special elements used in a template engine vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer Cloud 8.0.0, FortiManager 8.0.0, FortiManager Cloud 8.0.0 may allow an authenticated attacker with restricted privileges to execute unauthorized code or commands vi...

EUVD-2026-123842

A improper neutralization of special elements used in a template engine vulnerability in Fortinet FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2 all versions, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0...

CVE-2026-126234

A improper neutralization of special elements used in a template engine vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer Cloud 8.0.0, FortiManager 8.0.0, FortiManager Cloud 8.0.0 may allow an authenticated attacker with restricted privileges to execute unauthorized code or commands vi...

CVE-2026-126180

A improper neutralization of special elements used in a template engine vulnerability in Fortinet FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2 all versions, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0...

CVE-2026-126234

A improper neutralization of special elements used in a template engine vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer Cloud 8.0.0, FortiManager 8.0.0, FortiManager Cloud 8.0.0 may allow an authenticated attacker with restricted privileges to execute unauthorized code or commands vi...

CVE-2026-126234

A Server-Side Template Injection vulnerability (CWE-1336) exists in FortiManager , FortiManager Cloud , FortiAnalyzer , and FortiAnalyzer Cloud (all version 8.0.0). This flaw arises from the improper neutralization of special elements used in a template engine. An authenticated attacker with rest...

CVE-2026-126180

A vulnerability exists in FortiManager and FortiManager Cloud due to an improper neutralization of special elements used in a template engine [CWE-1336]. This flaw allows a low-privileged Device Manager admin to obtain super admin privileges on managed FortiGates by injecting malicious commands. ...

CVE-2026-126180

A improper neutralization of special elements used in a template engine vulnerability in Fortinet FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2 all versions, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0...

OTE

OSINT Template Engine OSINT Template Engine is an experimental tool for OSINT Information gathering & Attack Surface Mapping which uses customizable templates to collect data from sources. It allows for new template creation and modification of existing ones which gives it a competitive advantage...

CVE-2022-29078

CVE-2022-29078 | EJS SSTI → RCE White Hat School 4th Class 32 - Sangbeom Woo @taka3636 Summary EJS tags, such as Hello . Internally, EJS compiles the template string into a JavaScript function and then executes it to generate the final HTML. In other words, it is a code generator that "converts...

PT-2026-145504

Name of the Vulnerable Software and Affected Versions FortiManager versions 8.0.0 through 8.0.1 FortiManager versions 7.6.0 through 7.6.7 FortiManager versions 7.4.0 through 7.4.11 FortiManager version 7.2 FortiManager Cloud versions 8.0.0 through 8.0.1 FortiManager Cloud versions 7.6.0 through...

Fortinet FortiAnalyzer Improper neutralization of special elements used in a template engine (FG-IR-26-249)

The version of FortiAnalyzer installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-26-249 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version...

CVE-2026-126180: Fortinet: A improper neutralization of special elements used in a template engine vulnerability in Fortinet FortiManager 8.0.0…

A improper neutralization of special elements used in a template engine vulnerability in Fortinet FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2 all versions, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0...

CVE-2026-126234: Fortinet: A improper neutralization of special elements used in a template engine vulnerability in Fortinet FortiAnalyzer 8.0.0,…

A improper neutralization of special elements used in a template engine vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer Cloud 8.0.0, FortiManager 8.0.0, FortiManager Cloud 8.0.0 may allow an authenticated attacker with restricted privileges to execute unauthorized code or commands vi...

Fortinet FortiManager Improper neutralization of special elements used in a template engine i (FG-IR-26-225)

The version of FortiManager installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-26-225 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version...