CVE-2022-29078

CVE-2022-29078 vuln ejs 3.1.6 docker Setup git clone https://github.com/miko550/CVE-2022-29078.git cd CVE-2022-29078 docker build . -t miko/vuln-ejs docker run -p 49160:8080 -d --name vuln-ejs miko/vuln-ejs Usage http://127.0.0.1:49160/ Exploit In browser...

CVE-2024-7593

CVE-2024-7593 Detection How does this detection method work? This template matches on the following versions, if there is a match then the host is considered vulnerable: - "22.2" - "22.3" - "22.3R2" - "22.5R1" - "22.6R1" - "22.7R1" To prevent producing any FPs it also matches on the below: - type...

cve-2023-22527

Ejecución de Código Arbitrario en la Memoria de Confluence CVE-2023-22527 es una vulnerabilidad ampliamente conocida que afecta a Atlassian Confluence. La mayoría de los exploits para esta vulnerabilidad utilizan freemarker.template.utility.Execute para ejecutar un comando del sistema operativo,...

CVE-2024-51378

CVE-2024-51378 Analysis of the CVE-2024-51378 vulnerability, scripts for searching vulnerable hosts, using the exploit in single-threaded and multi-threaded mode in Python and nuclei. The use of scripts is allowed only for educational purposes on test hosts. 1-CVE-2024-51378.pdf - main file with ...

lodash.template-fixed

lodash.template v4.5.0 El método .template de Lodash exportado como un módulo de Node.js. Instalación Usando npm: $ sudo -H npm i -g npm $ npm i --save lodash.template En Node.js: var template = require'lodash.template'; Consulte la documentación o el código fuente del paquete para más detalles...

CVE-2026-63432

Horilla is an HR and CRM software. From 1.0.0 until 1.6.0 and 2.0.0, the getmailpreview handlers in recruitment/views/actions.py and employee/notinoutdashboard.py render a user-controlled body at /recruitment/get-mail-preview/ and /employee/get-employee-mail-preview with the full request object i...

CVE-2026-63432 Horilla: Server-Side Template Injection (SSTI) in Mail Preview Endpoints Allows Authenticated Users to Disclose Password Hashes and Server Metadata

Horilla is an HR and CRM software. From 1.0.0 until 1.6.0 and 2.0.0, the getmailpreview handlers in recruitment/views/actions.py and employee/notinoutdashboard.py render a user-controlled body at /recruitment/get-mail-preview/ and /employee/get-employee-mail-preview with the full request object i...

CVE-2026-63432 Horilla: Server-Side Template Injection (SSTI) in Mail Preview Endpoints Allows Authenticated Users to Disclose Password Hashes and Server Metadata

Horilla is an HR and CRM software. From 1.0.0 until 1.6.0 and 2.0.0, the getmailpreview handlers in recruitment/views/actions.py and employee/notinoutdashboard.py render a user-controlled body at /recruitment/get-mail-preview/ and /employee/get-employee-mail-preview with the full request object i...

CVE-2026-63432

The Horilla HR and CRM software (versions 1.0.0 until 1.6.0 and 2.0.0) contains a Server-Side Template Injection (SSTI) vulnerability. The get_mail_preview handlers in recruitment/views/actions.py and employee/not_in_out_dashboard.py render user-controlled content while including the full request...

CVE-2026-100372

ClipBucket v5 before 5.5.3-197 contains a path traversal vulnerability in the admin template editor that allows authenticated administrators to overwrite PHP files by supplying directory traversal sequences in the folder parameter. Attackers with managetemplateaccess permission can traverse outsi...

CVE-2026-100372

ClipBucket v5 versions prior to 5.5.3-#197 are vulnerable to a path traversal vulnerability within the admin template editor. Authenticated users with manage_template_access permissions can exploit the folder parameter by providing directory traversal sequences to move outside the layout director...

EUVD-2026-87315

ClipBucket v5 before 5.5.3-197 contains a path traversal vulnerability in the admin template editor that allows authenticated administrators to overwrite PHP files by supplying directory traversal sequences in the folder parameter. Attackers with managetemplateaccess permission can traverse outsi...

DEVVORTEX

DEVVORTEX HackTheBox: Devvortex — Resolución de la Máquina Un recorrido técnico exhaustivo que detalla el compromiso de la máquina Devvortex en HackTheBox. Esta ruta demuestra Fuzzing de Subdominios , Enumeración de la API de Joomla , Modificación de Plantillas para el acceso inicial, Extracción ...

cve-2019-17558-apache-solr-rce

Apache Solr RCE CVE-2019-17558 - CTF Write-up Practical exploitation of a Velocity Template Injection vulnerability in Apache Solr, progressing from a failure in an automated tool Metasploit to a successful manual exploitation. This write-up documents the complete reasoning of the exercise,...

CVE-2026-33937-for-DarkZeroReturns

POC for CVE-2026-33937 this is a poc for CVE-2026-33937 that was made with AI in order to exploit the Handelbars vulnerability in the Box DarkZeroRetuns the original poc https://github.com/EQSTLab/CVE-2026-33937/blob/main/exploit.py but it doesn't work for this specific box the poc was written by...

CVE-2025-68937

CVE-2025-68937 - Gitea/Forgejo Template Symlink RCE Automated proof-of-concept for CVE-2025-68937 : directory traversal via symlink dereferencing in Gitea and Forgejo template repository processing, leading to remote code execution. Any authenticated user no admin required can obtain a shell as t...

CVE-2025-67906

-c0392b?style=flat -orange?style=flat CVE-2025-67906 MISP = 2.5.27 - Cross-Site Scripting Almacenado a través del Motor de Workflow inyección de plantilla doT.js Descubierto porFranck FERMAN Resumen - Causa Raíz - Cadena de Ataque - Estructura - Uso - Remediación - Referencias Resumen de la...

CVE-2025-68493

CVE-2025-68493 CVE-2025-68493 7. Referencias 1 Vulnerabilidad ApacheStrutsXWorkXML CVE-2025-68493 PoC y script | ZONE.CI Red Global. https://zone.ci/secarticles/wx/486533.html 8. Verificación y explotación de la vulnerabilidad Para verificar y explotar la vulnerabilidad CVE-2025-68493, se pueden...

DEBIAN-CVE-2026-97596

In the Linux kernel, the following vulnerability has been resolved: ipvs: reject invalid states in connection template sync records IPVS sync receivers validate protocol states before creating or updating a connection. For connection templates, however, they only log states outside the template...

safetext

safetext This is not an officially supported Google product. Safe-by-construction libraries for producing formats like YAML, to replace syntax-unaware libraries like text/template and sprintf that are at risk of injection vulnerabilities. Example use-case Since text/template is not syntax-aware o...