CVE-2026-21448

Bagisto (Webkul Bagisto) is an open-source Laravel e-commerce platform. CVE-2026-21448 affects versions prior to 2.3.10 and is caused by a server-side template injection in the add-address step during checkout, which can lead to remote code execution. A patch is available in version 2.3.10. Some ...

PT-2026-1130

Name of the Vulnerable Software and Affected Versions Bagisto versions prior to 2.3.10 Description Bagisto, an open source Laravel eCommerce platform, is susceptible to server-side template injection through the type parameter. This can potentially lead to remote code execution. Recommendations...

CVE-2025-68929 Frappe may be vulnerable remote code execution due to server-side template injection

Frappe is a full-stack web application framework. Prior to versions 14.99.6 and 15.88.1, an authenticated user with specific permissions could be tricked into accessing a specially crafted link. This could lead to a malicious template being executed on the server, resulting in remote code...

CVE-2025-68929 Frappe may be vulnerable remote code execution due to server-side template injection

Frappe is a full-stack web application framework. Prior to versions 14.99.6 and 15.88.1, an authenticated user with specific permissions could be tricked into accessing a specially crafted link. This could lead to a malicious template being executed on the server, resulting in remote code...

📄 Crafty Controller 4.6.1 Remote Code Execution / Server-Side Template Injection

Crafty Controller version 4.6.1 allows authenticated remote attackers to execute arbitrary system commands on the target server through server-side template injection the webhook configuration feature...

CVE-2025-67843

A Server-Side Template Injection SSTI vulnerability in the MDX Rendering Engine in Mintlify Platform before 2025-11-15 allows remote attackers to execute arbitrary code via inline JSX expressions in an MDX file...

CVE-2025-67843

A Server-Side Template Injection SSTI vulnerability in the MDX Rendering Engine in Mintlify Platform before 2025-11-15 allows remote attackers to execute arbitrary code via inline JSX expressions in an MDX file...

CVE-2025-67843

A Server-Side Template Injection SSTI vulnerability in the MDX Rendering Engine in Mintlify Platform before 2025-11-15 allows remote attackers to execute arbitrary code via inline JSX expressions in an MDX file...

CVE-2025-67843

Mintlify Platform is affected by a Server-Side Template Injection (SSTI) in its MDX Rendering Engine prior to 2025-11-15. The vulnerability allows remote attackers to execute arbitrary code via inline JSX expressions in an MDX file. Affected component: MDX Rendering Engine in Mintlify Platform (p...

EUVD-2025-204427

A Server-Side Template Injection SSTI vulnerability in the MDX Rendering Engine in Mintlify Platform before 2025-11-15 allows remote attackers to execute arbitrary code via inline JSX expressions in an MDX file...

PT-2025-52404

Name of the Vulnerable Software and Affected Versions Mintlify Platform versions prior to 2025-11-15 Description A Server-Side Template Injection SSTI flaw exists in the MDX Rendering Engine of Mintlify Platform. This issue allows remote attackers to execute arbitrary code through inline JSX...

EUVD-2022-28777

Netaxis API Orchestrator APIO before 0.19.3 allows server side template injection SSTI...

CVE-2022-23851

Netaxis API Orchestrator APIO before 0.19.3 allows server side template injection SSTI...

EUVD-2025-203859

An input neutralization vulnerability in the Webhook Template component of Crafty Controller allows a remote, authenticated attacker to perform remote code execution via Server Side Template Injection...

CVE-2025-14700

CVE-2025-14700 affects Crafty Controller 4.6.1 in the Webhook Template component. The supplied documents describe an input neutralization vulnerability that enables authenticated attackers to achieve remote code execution via Server-Side Template Injection (SSTI). Multiple sources (NVD/Red Hat/CV...

CVE-2022-23851

Netaxis API Orchestrator APIO before 0.19.3 allows server side template injection SSTI...

PT-2025-51834

Name of the Vulnerable Software and Affected Versions Netaxis API Orchestrator APIO versions prior to 0.19.3 Description The Netaxis API Orchestrator APIO software contains a flaw that permits server side template injection SSTI. This issue could potentially allow an attacker to execute arbitrary...

Crafty Controller 安全漏洞

Crafty Controller is a Minecraft server control panel/launcher for Arcadia. A security vulnerability exists in Crafty Controller that stems from improper input neutralization of the Webhook Template component, which could lead to remote code execution via server-side template injection...

📄 Invision Community 5.0.6 customCss Expression Injection

Invision Community version 5.0.6 customCss expression injection proof of concept exploit written in PHP. ============================================================================================================================================= | Title : Invision Community 5.0.6 customCss...

CVE-2025-66437

An SSTI Server-Side Template Injection vulnerability exists in the getaddressdisplay method of Frappe ERPNext through 15.89.0. This function renders address templates using frappe.rendertemplate with a context derived from the addressdict parameter, which can be either a dictionary or a string...