CVE-2025-52122

CVE CraftCMS Freeform CraftCMS Freeform contains an SSTI vulnerability, resulting in arbitrary code injection for all users that have access to editing a form submission title. Vulnerable versions are v5.0.0 test % set form = freeform.form'pentest' % % if form % form.render % else % Form not foun...

tplmap

Tplmap This project is no longer maintained. I'm happy to merge new PRs as long they don't break the test suite. Tplmap assists the exploitation of Code Injection and Server-Side Template Injection vulnerabilities with a number of sandbox escape techniques to get access to the underlying operatin...

CVE-2024-6386

CVE-2024-6386 - RCE via Twig SSTI in WPML PoC PoC on Python+Selenium Detailed research in Russian: CVE-2024-6386 CVSS Base Score: 9.9 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Summary In WPML you are available to use specific WordPress Shortcodes that allows you to create macroses and...

CVE-2022-23614

CVE-2022-23614 Proof of concept PoC for CVE-2022-23614 referenced in the DSA-5107-1. CVSS-2.0 : 7.5 CVSS-3.X : 9.8 Explanation Twig is a flexible, fast, and secure template engine for PHP. Notably, it is possible to use filters in a template before rendering it. The sort filter can be used to sor...

CVE-2022-23614

CVE-2022-23614 PoC for CVE-2022-23614, GHSA-5mv2-rx3q-4w2v Twig sort filter code execution/sandbox bypass As seen in this commit - https://github.com/twigphp/Twig/commit/.., twig was passing user supplied function name as a callback parameter to uasort here, thus leading to arbitrary code executi...

cve-2026-9558-poc

CVE-2026-9558 — Mautic Theme Templates Server-Side Template Injection SSTI to Full Admin Takeover Table of Contents Overview Affected Versions Root Cause Analysis Repository Structure Requirements Usage Expected Output References Disclaimer Overview CVE-2026-9558 is a Server-Side Template Injecti...

WordPress Contact Form by Supsystic - Server-Side Template Injection

Contact Form by Supsystic WordPress plugin = 1.7.36 contains a server-side template injection caused by unsandboxed TwigLoaderString and cfsPreFill functionality, letting unauthenticated attackers execute arbitrary code remotely via GET parameters. id: CVE-2026-4257 info: name: WordPress Contact...

CVE-2026-23498

CVE-2026-23498: Shopware Has Improper Control of Generation of Code in Twig rendered views Overview Field| Details ---|--- CVE ID| CVE-2026-23498 Severity| HIGH Advisory| View Advisory Discovered by| Lukasz Rybak Affected Products shopware/shopware versions: = 6.7.0.0, = 6.7.0.0, 6.7.6.1 CWE...

CVE-2026-28134

CVE-2026-28134 Exploitation Report JetEngine = 3.7.2 — Authenticated Contributor+ Remote Code Execution via Twig SSTI Date: March 11, 2026 CVSS Score: 8.8 High CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Plugin: JetEngine = 3.7.2 Plugin Slug: jet-engine CVE: CVE-2026-28134...

CVE-2026-22692

CVE-2026-22692: Critical Twig Sandbox Bypass via collect-mapInto allowing RCE/LFI/XXE October CMS Overview Field| Details ---|--- CVE ID| CVE-2026-22692 Severity| Moderate CVSS:3.1 4.9 Advisory| GHSA-m5qg-jc75-4jp6 Affected Product| October CMS RCE, LFI, XXE Discovered by| Lukasz Rybak CWE...

CVE-2026-31857

CVE-2026-31857 - Craft CMS RCE exploit Python exploit for a RCE vulnerability in the Craft CMS admin panel, triggered via the admin/actions/element-indexes/count-elements endpoint. The injection goes through the elementIds field of a RelatedToConditionRule condition, which gets interpreted as Twi...

CVE-2026-31857

CVE-2026-31857: Craft CMS control panel RCE CVE-2026-31857 is a remote code execution issue in Craft CMS relational condition rules. BaseElementSelectConditionRule::getElementIds renders user-controlled input as an unsandboxed Twig template. An authenticated Control Panel user can submit a crafte...

CVE-2026-28496-Lab

CVE-2026-28496 - FOSSBilling Server-Side Template Injection in Twig Rendering Executive Summary This repository contains a local Docker lab for reproducing and validating CVE-2026-28496, a Server-Side Template Injection vulnerability affecting FOSSBilling's Twig template rendering behavior...

cachet_2.4.0-dev

CVE-2021-39174 Cachet 2.4.0-dev A python3 script for CVE-2021-39174 Cachet 2.4.0-dev Information Disclosure and RCE via Twig Server Side Template Injection. For the RCE the API KEY for the user is needed. Check out the Leave Songs link below which covers how to get the API KEY via SQL Injection...

CVE-2021-29440

CVE-2021-29440 Unsafe Twig processing of static pages leading to RCE in Grav CMS 1.7.10 Grav is a file based Web-platform. Twig processing of static pages can be enabled in the front matter by any administrative user allowed to create or edit pages. As the Twig processor runs unsandboxed, this...

CVE-2026-78851

Grav Authenticated Path Traversal / Arbitrary Directory Disclosure via Twig mediadirectory Reporter Name: CYBER-SEC Contact: [email protected] Summary Grav's Twig function mediadirectory is exposed inside the page-content Twig sandbox allowlist but does not properly enforce path containment...

pyrocms-ssti-fix

🛡️ PyroCMS SSTI Fix Drop-in security fix for CVE-2023-29689 - Server-Side Template Injection leading to Remote Code Execution in PyroCMS 3.9. The Problem PyroCMS allows admin users to edit templates stored in the database. Without sandboxing, attackers with admin access can inject malicious Twig...

Information Exposure

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Information Exposure in the getcookie function within the Twig sandbox. An attacker can obtain session identifiers belonging to privileged use...

Information Exposure

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Information Exposure in the array filter, which is registered without the necessary sandboxing guard. An attacker can access sensitive...

CVE-2026-100720

Froxlor 2.0.0 through 2.3.10 is vulnerable to stored cross-site scripting. When a customer the lowest-privileged authenticated role uploads an SSL certificate for one of their own domains, the Certificates API add/update methods parse it with opensslx509parse and store the issuer organization...