136 matches found
CVE-2022-29078
CVE-2022-29078 | EJS SSTI → RCE WhiteHat School 4ª coorte classe 32 - Sangbeom Woo @taka3636 Sommario La vulnerabilità di server-side template injection SSTI in EJS , ad esempio Hello . Internamente, EJS compila la stringa del template in una funzione JavaScript e la esegue per generare l'HTML...
PoC-CVE-2024-33883
CVE-2024-33883 [email protected], Unzureichende Prototype-Pollution-Validierung führt zu RCE-Ausnutzung Mit Prototype Pollution setze opts.client auf einen truthy-Wert Bedingung Dann, wenn render ausgeführt wird, führt ejs den Wert von opts.escapeFunction als JS-Code aus. Angreifbarer...
CVE-2022-29078
CVE-2022-29078 ejs 3.1.6 docker vulnerabile Configurazione root@kitploit: git clone https://github.com/miko550/CVE-2022-29078.git cd CVE-2022-29078 docker build . -t miko/vuln-ejs docker run -p 49160:8080 -d --name vuln-ejs miko/vuln-ejs Utilizzo root@kitploit: http://127.0.0.1:49160/ Exploit Nel...
CVE-2022-29078
CVE-2022-29078 PoC simple pour CVE-2022-29078 vulnérabilité ejs 3.1.6 Utilisation root@kitploit: git clone https://github.com/chuckdu21/CVE-2022-29078.git cd CVE-2022-29078 python3 CVE-2022-29078.py Une invite apparaîtra pour exécuter des commandes root@kitploit: $ id uid=0root gid=0root...
vuln-ejs-critical
Questo repository non contiene un README...
Embedded JavaScript(EJS) 3.1.6 - Template Injection
ejs v3.1.9 is vulnerable to server-side template injection. If the ejs file is controllable, template injection can be implemented through the configuration settings of the closeDelimiter parameter. id: CVE-2023-29827 info: name: Embedded JavaScriptEJS 3.1.6 - Template Injection author:...
Node.js Embedded JavaScript 3.1.6 - Template Injection
Node.js Embedded JavaScript 3.1.6 is susceptible to server-side template injection via settingsview optionsoutputFunctionName, which is parsed as an internal option and overwrites the outputFunctionName option with an arbitrary OS command, which is then executed upon template compilation. id:...
VulnNodeApp
VulnNodeApp Eine angreifbare Anwendung, die mit node.js, express server und ejs template engine erstellt wurde. Diese Anwendung ist ausschließlich für Bildungszwecke gedacht. Einrichtung Repository klonen root@kitploit: git clone https://github.com/4auvar/VulnNodeApp.git Anwendungseinrichtung:...
CLSA-2026-1774570929 TuxCare security update for ejs (19 CVEs)
TuxCare rebuilt ejs to address 19 CVEs. Fixed in 1.0.0-tuxcare.1...
MGASA-2026-0234 Updated yt-dlp packages fix security vulnerabilities
CVE-2026-50019 If curl is used as an external downloader for yt-dlp, cookies may be leaked to an unintended host upon HTTP redirect or when the host for download fragments differs from their parent manifest's. CVE-2026-50023 A vulnerability exists in yt-dlp that allows a remote attacker to write...
CVE-2026-47376
CVE-2026-47376 (NocoDB) describes a reflected XSS on the password-reset flow. Before 2026.04.1, the token from the password-reset URL was directly embedded into a JavaScript string in a server-rendered EJS template, which does not escape single quotes or backslashes. This allowed an attacker-cont...
NocoDB: Reflected Cross-Site Scripting via Password Reset Token
Summary The password-reset page rendered the URL token directly into a JavaScript string literal in a server-rendered EJS template. EJS HTML-entity-encodes a fixed set of characters but does not escape single quotes or backslashes, so a crafted token could break out of the JS string context and...
Astra Linux – Vulnerability in Node-EJS
The ejs also known as Embedded JavaScript templates package in Node.js before version 3.1.10 lacked certain measures to prevent pollution...
CVE-2026-41951
Path traversal vulnerability exists in GROWI v7.5.0 and earlier, which may allow an attacker to execute arbitrary EJS templates on the server when an email server is running in GROWI...
Exploit for Code Injection in Ejs
No d...
PYSEC-2026-2265
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 6.9.5, the safeEjs.ts file does not properly sanitize EJS templates. Users with the Manage customization capability can run arbitrary JavaScript in the context of the OpenCTI platform...
CVE-2026-39980 OpenCTI affected by RCE via notifier template
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 6.9.5, the safeEjs.ts file does not properly sanitize EJS templates. Users with the Manage customization capability can run arbitrary JavaScript in the context of the OpenCTI platform...
CVE-2026-39980
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 6.9.5, the safeEjs.ts file does not properly sanitize EJS templates. Users with the Manage customization capability can run arbitrary JavaScript in the context of the OpenCTI platform...
Security Bulletin: Multiple open source vulnerabilities affect IBM Db2 Big SQL on Cloud Pak for Data
Summary Multiple open source vulnerabilities affect IBM Db2 Big SQL 7 on Cloud Pak for Data 5 Vulnerability Details CVEID:CVE-2024-37891 DESCRIPTION: urllib3 could allow a remote authenticated attacker to obtain sensitive information, caused by the failure to strip the Proxy-Authorization header...
