CVE-2019-14965

An issue was discovered in Frappe Framework 10 through 12 before 12.0.4. A server side template injection SSTI issue exists...

CVE-2019-10100

In JetBrains YouTrack Confluence plugin versions before 1.8.1.3, it was possible to achieve Server Side Template Injection. The attacker could add an Issue macro to the page in Confluence, and use a combination of a valid id field and specially crafted code in the link-text-template field to...

CVE-2025-20256 Cisco Secure Network Analytics Manager Server-Side Template Injection Vulnerability

A vulnerability in the web-based management interface of Cisco Secure Network Analytics Manager and Cisco Secure Network Analytics Virtual Manager could allow an authenticated, remote attacker with valid administrative credentials to execute arbitrary commands as root on the underlying operating...

CVE-2025-20256

CVE-2025-20256 affects Cisco Secure Network Analytics Manager and Cisco Secure Network Analytics Virtual Manager. The issue is in the web-based management interface, caused by insufficient input validation in specific fields. An authenticated administrator can send crafted input to an affected de...

Server-Side Template Injection Vulnerabilities and Exploitation Techniques

Research article called Server-Side Template Injection SSTI Vulnerabilities and Exploitation Techniques. The paper provides a structured methodology for detecting and exploiting SSTI vulnerabilities across multiple template engines, along with real-world case studies and mitigation strategies...

PT-2025-18960 · Unknown · Fastify/View

Name of the Vulnerable Software and Affected Versions: @fastify/view affected versions not specified Description: The issue concerns a potential Remote Code Execution RCE vulnerability in the @fastify/view plugin for Fastify, which allows the use of template engines for generating HTML pages on t...

CVE-2025-46661

IPW Systems Metazo through 8.1.3 allows unauthenticated Remote Code Execution because smartyValidator.php enables the attacker to provide template expressions, aka Server-Side Template-Injection. All instances have been patched by the Supplier...

CVE-2025-46661

IPW Systems Metazo through 8.1.3 allows unauthenticated Remote Code Execution because smartyValidator.php enables the attacker to provide template expressions, aka Server-Side Template-Injection. All instances have been patched by the Supplier...

PT-2025-18069 · Ipw Systems · Ipw Systems Metazo

Name of the Vulnerable Software and Affected Versions: IPW Systems Metazo versions 8.1.3 and earlier Description: The issue allows for unauthenticated Remote Code Execution because smartyValidator.php enables the attacker to provide template expressions, also known as Server-Side...

CVE-2025-46661

IPW Systems Metazo through 8.1.3 allows unauthenticated Remote Code Execution because smartyValidator.php enables the attacker to provide template expressions, aka Server-Side Template-Injection. All instances have been patched by the Supplier...

CVE-2025-46661

IPW Systems Metazo through 8.1.3 allows unauthenticated Remote Code Execution because smartyValidator.php enables the attacker to provide template expressions, aka Server-Side Template-Injection. All instances have been patched by the Supplier...

CVE-2025-46661

IPW Systems Metazo up to version 8.1.3 is affected by unauthenticated Remote Code Execution via Server-Side Template-Injection through smartyValidator.php. The issue affects versions 8.1.3 and earlier; all instances have been patched by the supplier. CVSS metrics shown in sources indicate a criti...

BIT-OPENCART-2024-36694

OpenCart 4.0.2.3 is vulnerable to Server-Side Template Injection SSTI via the Theme Editor Function...

CVE-2025-1040

AutoGPT versions 0.3.4 and earlier are vulnerable to a Server-Side Template Injection SSTI that could lead to Remote Code Execution RCE. The vulnerability arises from the improper handling of user-supplied format strings in the AgentOutputBlock implementation, where malicious input is passed to t...

CVE-2025-1040 Server-Side Template Injection (SSTI) in significant-gravitas/autogpt

AutoGPT versions 0.3.4 and earlier are vulnerable to a Server-Side Template Injection SSTI that could lead to Remote Code Execution RCE. The vulnerability arises from the improper handling of user-supplied format strings in the AgentOutputBlock implementation, where malicious input is passed to t...

CVE-2025-1040 Server-Side Template Injection (SSTI) in significant-gravitas/autogpt

AutoGPT versions 0.3.4 and earlier are vulnerable to a Server-Side Template Injection SSTI that could lead to Remote Code Execution RCE. The vulnerability arises from the improper handling of user-supplied format strings in the AgentOutputBlock implementation, where malicious input is passed to t...

CVE-2025-1040

CVE-2025-1040 : AutoGPT versions 0.3.4 and earlier are vulnerable to a Server-Side Template Injection (SSTI) that can lead to Remote Code Execution (RCE). The root cause is improper handling of user-supplied format strings in the AgentOutputBlock, where input is passed to the Jinja2 templating en...

CVE-2025-1040 Server-Side Template Injection (SSTI) in significant-gravitas/autogpt

AutoGPT versions 0.3.4 and earlier are vulnerable to a Server-Side Template Injection SSTI that could lead to Remote Code Execution RCE. The vulnerability arises from the improper handling of user-supplied format strings in the AgentOutputBlock implementation, where malicious input is passed to t...

CVE-2025-26865 Apache OFBiz: Server-Side Template Injection affecting the ecommerce plugin leading to possible RCE

Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz. This issue affects Apache OFBiz: from 18.12.17 before 18.12.18. It's a regression between 18.12.17 and 18.12.18. In case you use something like that, which is not recommended! For security, only...

Server-side Template Injection (SSTI)

spacyllm is vulnerable to Server-Side Template Injection SSTI. The vulnerability is due to improper input validation in the template field, allowing attackers to execute Remote Code Execution RCE by injecting a crafted payload...