825 matches found
CVE-2025-35113
CVE-2025-35113 affects Agiloft Release 28, where improper neutralization of elements in the EUI template engine enables an authenticated attacker to achieve remote code execution by loading a specially crafted payload. The issue is mitigated by upgrading to Agiloft Release 31 (per Red Hat, NVD/CV...
CVE-2025-35113 Agiloft improper neutralization in EUI template engine
Agiloft Release 28 does not properly neutralize special elements used in an EUI template engine, allowing an authenticated attacker to achieve remote code execution by loading a specially crafted payload. Users should upgrade to Agiloft Release 31...
Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in jinja2-3.1.5-py3-none-any.whl
Summary IBM Watson Discovery Cartridge contains a vulnerable version of jinja2-3.1.5-py3-none-any.whl Vulnerability Details CVEID:CVE-2025-27516 DESCRIPTION: Jinja is an extensible templating engine. Prior to 3.1.6, an oversight in how the Jinja sandboxed environment interacts with the |attr filt...
Agiloft 安全漏洞
Agiloft is a contract management platform from Agiloft Corporation, USA. A security vulnerability exists in Agiloft Release 28 that stems from improper handling of special elements in the EUI template engine, which could lead to remote code execution...
PT-2025-34814 · Agiloft · Agiloft
Name of the Vulnerable Software and Affected Versions: Agiloft versions prior to 31 Description: Agiloft Release 28 does not properly neutralize special elements used in an EUI template engine, allowing an authenticated attacker to achieve remote code execution by loading a specially crafted...
CVE-2025-53194
Deserialization of Untrusted Data vulnerability in Crocoblock JetEngine jet-engine allows Code Injection.This issue affects JetEngine: from n/a through = 3.7.0...
Improper Neutralization of Special Elements Used in a Template Engine
Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements Used in a Template Engine via improper handling of dynamic template rendering in the HTTP Meta Info field of the Global Preferences Presentation section. An attacker can execute arbitrary...
CVE-2025-51991
XWiki through version 17.3.0 is vulnerable to Server-Side Template Injection SSTI in the Administration interface, specifically within the HTTP Meta Info field of the Global Preferences Presentation section. An authenticated administrator can inject crafted Apache Velocity template code, which is...
CVE-2025-53194
Deserialization of Untrusted Data vulnerability in Crocoblock JetEngine jet-engine allows Code Injection.This issue affects JetEngine: from n/a through = 3.7.0...
CVE-2025-53194
The CVE-2025-53194 entry describes a vulnerability in Crocoblock JetEngine (WordPress plugin) up to version 3.7.0: Improper neutralization of special elements in the template engine leading to code injection/remote code execution. Affected product: JetEngine (WordPress plugin). Root cause: improp...
CVE-2025-53194 WordPress JetEngine <= 3.7.0 - Remote Code Execution (RCE) Vulnerability
Deserialization of Untrusted Data vulnerability in Crocoblock JetEngine jet-engine allows Code Injection.This issue affects JetEngine: from n/a through = 3.7.0...
WordPress plugin JetEngine 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...
PT-2025-33965 · WordPress · Crocoblock Jetengine
Name of the Vulnerable Software and Affected Versions: Crocoblock JetEngine versions through 3.7.0 Description: Improper neutralization of special elements used in a template engine in Crocoblock JetEngine allows code injection. Recommendations: Update Crocoblock JetEngine to a version later than...
CVE-2025-51991
XWiki through version 17.3.0 is vulnerable to Server-Side Template Injection SSTI in the Administration interface, specifically within the HTTP Meta Info field of the Global Preferences Presentation section. An authenticated administrator can inject crafted Apache Velocity template code, which is...
CVE-2025-9094 ThingsBoard Add Gateway special elements used in a template engine
A vulnerability was detected in ThingsBoard 4.1. This vulnerability affects unknown code of the component Add Gateway Handler. The manipulation leads to improper neutralization of special elements used in a template engine. The attack can be initiated remotely. The exploit has been disclosed to t...
CVE-2025-9094 ThingsBoard Add Gateway special elements used in a template engine
A vulnerability was detected in ThingsBoard 4.1. This vulnerability affects unknown code of the component Add Gateway Handler. The manipulation leads to improper neutralization of special elements used in a template engine. The attack can be initiated remotely. The exploit has been disclosed to t...
CVE-2025-9094 ThingsBoard Add Gateway special elements used in a template engine
A vulnerability was detected in ThingsBoard 4.1. This vulnerability affects unknown code of the component Add Gateway Handler. The manipulation leads to improper neutralization of special elements used in a template engine. The attack can be initiated remotely. The exploit has been disclosed to t...
ThingsBoard 安全漏洞
ThingsBoard is a Java-based platform for IOT devices for monitoring, management, and data collection by the ThingsBoard team. A security vulnerability exists in ThingsBoard version 4.1, which stems from the Add Gateway Handler component improperly neutralizing special elements of the template...
PT-2025-33619
Name of the Vulnerable Software and Affected Versions: ThingsBoard version 4.1 Description: A vulnerability exists in ThingsBoard that affects unknown code within the Add Gateway Handler component. The issue involves improper neutralization of special elements used in a template engine, allowing...
