Sql injection

JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI Server-Side Template Injection via FreeMarker templates...

CVE-2022-24442

JetBrains YouTrack (pre-2021.4.40426) is affected by SSTI via FreeMarker templates. The issue, CVE-2022-24442, allows server-side template injection and may enable remote code execution; the fix is to update to 2021.4.40426 or later. A public exploit PoC exists on GitHub outlining the RCE possibi...

SRC-2022-0005 : VMware Workspace ONE Access customError.ftl Server-side Template Injection Remote Code Execution Vulnerability

Vulnerability Details: This vulnerability allows remote attackers to execute arbitrary code on affected installations of VMware Workspace ONE Access. Authentication is not required to exploit this vulnerability. The specific flaw exists within the customError.ftl template. The issue results from...

GitHub Security Lab: Java : Add query to detect Server Side Template Injection (SSTI)

This bug was reported directly to GitHub Security Lab...

GHSA-GC79-GH4F-9G6W Server Side Template Injection in MCMS

MCMS v5.2.5 was discovered to contain a Server Side Template Injection SSTI vulnerability via the Template Management module...

Server Side Template Injection in MCMS

MCMS v5.2.5 was discovered to contain a Server Side Template Injection SSTI vulnerability via the Template Management module...

CVE-2021-46063

MCMS v5.2.5 was discovered to contain a Server Side Template Injection SSTI vulnerability via the Template Management module...

Sql injection

MCMS v5.2.5 was discovered to contain a Server Side Template Injection SSTI vulnerability via the Template Management module...

MingSoft MCMS 代码代码注入漏洞

MingSoft MCMS is a complete open source J2ee system from MingSoft, China. A code injection vulnerability exists in MingSoft MCMS that stems from the inclusion of a server-side template injection SSTI vulnerability in the template management...

CVE-2021-46362

Magnolia CMS is affected by a Server-Side Template Injection (SSTI) in the Registration and Forgotten Password forms via the fullname parameter for Magnolia versions prior to 6.2.3. The root cause is SSTI that can allow arbitrary code execution, with high-severity impact (CVSS 3.1: CRITICAL, base...

specberus (>=4.4.4, <=5.6.2) potentially affected by CVE-2021-32820 via express-handlebars (>=5.1.0, <=5.3.0)

express-handlebars NPM version =5.1.0, =4.4.4, =5.6.2 Source cves: CVE-2021-32820 Source advisory: OSV:GHSA-FR76-2WP8-FP92...

Server side template injection — SSTI vulnerability ⚠️

Server side template injection — SSTI vulnerability ⚠️ Introduction There is hardly any software development or other linked elements that haven’t fallen into the trap of cyber vulnerabilities. Templates, used for HTML code management on the server-side, are amongst them. The attack targeting the...

VulnCheck KEV: CVE-2020-8644

PlaySMS contains a server-side template injection vulnerability that allows for remote code execution...

bem-register (>=1.0.0, <=1.0.5), itstep_server (0.0.1) +4 more potentially affected by CVE-2021-23372 via mongo-express (>=0.19.0, <=0.53.0)

mongo-express NPM version =0.19.0, =1.0.0, =0.1.1, =1.0.0, =1.5.0, =1.6.1 Source cves: CVE-2021-23372 Source advisory: OSV:GHSA-M2R3-8492-VX59...

Sql injection

Affected versions of Atlassian Jira Server or Data Center using the Jira Service Management addon allow remote attackers with JIRA Administrators access to execute arbitrary Java code via a server-side template injection vulnerability in the Email Template feature. The affected versions of Jira...

CVE-2021-39128

Affected versions of Atlassian Jira Server or Data Center using the Jira Service Management addon allow remote attackers with JIRA Administrators access to execute arbitrary Java code via a server-side template injection vulnerability in the Email Template feature. The affected versions of Jira...

Atlassian Jira 代码注入漏洞

Atlassian Jira is a defect tracking management system from Atlassian Australia. The system is used to track and manage all types of issues and defects in the workplace. A security vulnerability exists in Atlassian Jira that can be exploited by a remote attacker with a "Jira administrator" to acce...

CVE-2021-35450

A Server Side Template Injection in the Entando Admin Console 6.3.9 and before allows a user with privileges to execute FreeMarker template with command execution via freemarker.template.utility.Execute...

Sql injection

A Server Side Template Injection in the Entando Admin Console 6.3.9 and before allows a user with privileges to execute FreeMarker template with command execution via freemarker.template.utility.Execute...

CVE-2021-35450

CVE-2021-35450 concerns a Server Side Template Injection in the Entando Admin Console, affecting version 6.3.9 and earlier. The flaw allows a user with privileges to trigger FreeMarker template execution via freemarker.template.utility.Execute, potentially enabling command execution. According to...