CVE-2024-6386

CVE-2024-6386 - RCE via Twig SSTI in WPML PoC PoC on Python+Selenium Detailed research in Russian: CVE-2024-6386 CVSS Base Score: 9.9 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Summary In WPML you are available to use specific WordPress Shortcodes that allows you to create macroses and...

CVE-2021-29440

CVE-2021-29440 Unsafe Twig processing of static pages leading to RCE in Grav CMS 1.7.10 Grav is a file based Web-platform. Twig processing of static pages can be enabled in the front matter by any administrative user allowed to create or edit pages. As the Twig processor runs unsandboxed, this...

CVE-2022-23614

CVE-2022-23614 PoC for CVE-2022-23614, GHSA-5mv2-rx3q-4w2v Twig sort filter code execution/sandbox bypass As seen in this commit - https://github.com/twigphp/Twig/commit/.., twig was passing user supplied function name as a callback parameter to uasort here, thus leading to arbitrary code executi...

EUVD-2026-109206

Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is evaluated as a sandboxed Twig object template. Craft’s allowed column filter delegates property lookup to Yii ArrayHelper, outside Twig’s SecurityPolicy. Repeated single-segment...

CVE-2026-115938

Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is evaluated as a sandboxed Twig object template. Craft’s allowed column filter delegates property lookup to Yii ArrayHelper, outside Twig’s SecurityPolicy. Repeated single-segment...

CVE-2026-115938 Low privilege condition filter escapes Twig sandbox, recovers "securityKey" and reaches RCE

Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is evaluated as a sandboxed Twig object template. Craft’s allowed column filter delegates property lookup to Yii ArrayHelper, outside Twig’s SecurityPolicy. Repeated single-segment...

CVE-2026-115938

In Craft CMS , an authenticated control panel user can exploit a vulnerability where the allowed column filter delegates property lookups to Yii ArrayHelper , bypassing the Twig sandbox 's security policies. By submitting an element-search condition, an attacker can use repeated single-segment lo...

CVE-2025-52122

CVE CraftCMS Freeform CraftCMS Freeform contains an SSTI vulnerability, resulting in arbitrary code injection for all users that have access to editing a form submission title. Vulnerable versions are v5.0.0 test % set form = freeform.form'pentest' % % if form % form.render % else % Form not foun...

CVE-2026-28134

CVE-2026-28134 Exploitation Report JetEngine = 3.7.2 — Authenticated Contributor+ Remote Code Execution via Twig SSTI Date: March 11, 2026 CVSS Score: 8.8 High CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Plugin: JetEngine = 3.7.2 Plugin Slug: jet-engine CVE: CVE-2026-28134...

tplmap

Tplmap This project is no longer maintained. I'm happy to merge new PRs as long they don't break the test suite. Tplmap assists the exploitation of Code Injection and Server-Side Template Injection vulnerabilities with a number of sandbox escape techniques to get access to the underlying operatin...

CVE-2026-31857

CVE-2026-31857 - Craft CMS RCE exploit Python exploit for a RCE vulnerability in the Craft CMS admin panel, triggered via the admin/actions/element-indexes/count-elements endpoint. The injection goes through the elementIds field of a RelatedToConditionRule condition, which gets interpreted as Twi...

CVE-2026-31857

CVE-2026-31857: Craft CMS control panel RCE CVE-2026-31857 is a remote code execution issue in Craft CMS relational condition rules. BaseElementSelectConditionRule::getElementIds renders user-controlled input as an unsandboxed Twig template. An authenticated Control Panel user can submit a crafte...

cachet_2.4.0-dev

CVE-2021-39174 Cachet 2.4.0-dev A python3 script for CVE-2021-39174 Cachet 2.4.0-dev Information Disclosure and RCE via Twig Server Side Template Injection. For the RCE the API KEY for the user is needed. Check out the Leave Songs link below which covers how to get the API KEY via SQL Injection...

CVE-2026-55600

Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.2, Part-DB renders BOM validation information messages using Twig's |raw filter. These messages include translated placeholders populated with user-controlled Part names. A user who can edit a...

EUVD-2026-108576

Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.2, Part-DB renders BOM validation information messages using Twig's |raw filter. These messages include translated placeholders populated with user-controlled Part names. A user who can edit a...

CVE-2026-55600

Part-DB, an open source inventory management system for electronic components, is vulnerable to a cross-user stored HTML injection in versions prior to 2.12.2 . The root cause is the use of Twig's |raw filter to render BOM validation messages containing user-controlled Part names without proper e...

CVE-2026-55600 Part-DB: Stored HTML injection in BOM validation results via unescaped Part name

Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.2, Part-DB renders BOM validation information messages using Twig's |raw filter. These messages include translated placeholders populated with user-controlled Part names. A user who can edit a...

WordPress Contact Form by Supsystic - Server-Side Template Injection

Contact Form by Supsystic WordPress plugin = 1.7.36 contains a server-side template injection caused by unsandboxed TwigLoaderString and cfsPreFill functionality, letting unauthenticated attackers execute arbitrary code remotely via GET parameters. id: CVE-2026-4257 info: name: WordPress Contact...

PT-2026-121746

Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.2, Part-DB renders BOM validation information messages using Twig's |raw filter. These messages include translated placeholders populated with user-controlled Part names. A user who can edit a...

CVE-2026-78851

Grav Authenticated Path Traversal / Arbitrary Directory Disclosure via Twig mediadirectory Reporter Name: CYBER-SEC Contact: [email protected] Summary Grav's Twig function mediadirectory is exposed inside the page-content Twig sandbox allowlist but does not properly enforce path containment...