Local File System Validation Bypass Leading to File Overwrite, Sensitive File Access, and Potential Code Execution

Summary A vulnerability in CraftCMS allows an attacker to bypass local file system validation by utilizing a double file:// scheme e.g., file://file:////. This enables the attacker to specify sensitive folders as the file system, leading to potential file overwriting through malicious uploads,...

PT-2024-35157 · Craft Cms · Craft Cms

Name of the Vulnerable Software and Affected Versions: CraftCMS versions prior to 4.12.5 CraftCMS versions prior to 5.4.6 Description: A vulnerability in CraftCMS allows an attacker to bypass local file system validation by utilizing a double file:// scheme. This enables the attacker to specify...

GHSA-4R7V-WHPG-8RX3 changedetection.io has a Server Side Template Injection using Jinja2 which allows Remote Command Execution

Summary A Server Side Template Injection in changedetection.io caused by usage of unsafe functions of Jinja2 allows Remote Command Execution on the server host. Details changedetection.io version: 0.45.20 docker images REPOSITORY TAG IMAGE ID CREATED SIZE dgtlmoon/changedetection.io latest...

changedetection.io has a Server Side Template Injection using Jinja2 which allows Remote Command Execution

Summary A Server Side Template Injection in changedetection.io caused by usage of unsafe functions of Jinja2 allows Remote Command Execution on the server host. Details changedetection.io version: 0.45.20 docker images REPOSITORY TAG IMAGE ID CREATED SIZE dgtlmoon/changedetection.io latest...

Exploit for Code Injection in Getgrav Grav

EN GenGravSSTIExploit is a PoC Python script that exploits...

CVE-2024-45186

FileSender before 2.49 allows server-side template injection SSTI for retrieving credentials...

Exploit for Code Injection in Crushftp

EN GenCrushSSTIExploit is a PoC exploit tool targeting the...

PT-2025-2740

Name of the Vulnerable Software and Affected Versions: Yeti Platform affected versions not specified Description: The issue is related to insufficient input validation, which can allow a remote attacker to execute arbitrary code or implement a Server Side Template Injection SSTI attack. No specif...

Exploit for CVE-2024-32651

CVE-2024-32651 changedetection --port --ip --notification...

Server-side Template Injection (SSTI)

ethycafides is vulnerable to Server-Side Template Injection SSTI. The vulnerability is due to improper input sanitization and lack of rendering environment restrictions in the Jinja2 templating engine used in the Email Templating feature of Fides, which allows privileged users to execute remote...

CVE-2024-45053 Remote Code Execution Vulnerability via SSTI in Fides Webserver Jinja Email Templating Engine

Fides is an open-source privacy engineering platform. Starting in version 2.19.0 and prior to version 2.44.0, the Email Templating feature uses Jinja2 without proper input sanitization or rendering environment restrictions, allowing for Server-Side Template Injection that grants Remote Code...

CVE-2024-45053 Remote Code Execution Vulnerability via SSTI in Fides Webserver Jinja Email Templating Engine

Fides is an open-source privacy engineering platform. Starting in version 2.19.0 and prior to version 2.44.0, the Email Templating feature uses Jinja2 without proper input sanitization or rendering environment restrictions, allowing for Server-Side Template Injection that grants Remote Code...

CVE-2024-45053

Fides (open‑source privacy engineering platform) is affected by a Server‑Side Template Injection in the Email Templating feature using Jinja2, allowing Remote Code Execution by privileged Admin UI users. Cloaked between versions 2.19.0 and before 2.44.0, the issue arises from insufficient input s...

CrushFTP Unauthenticated Arbitrary File Read

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'CrushFTP Unauthenticated Arbitrary File Read', 'Description' = %q This module leverages an unauthenticated server-side template injection...

Critical WPML Plugin Flaw Exposes WordPress Sites to Remote Code Execution

A critical security flaw has been disclosed in the WPML WordPress multilingual plugin that could allow authenticated users to execute arbitrary code remotely under certain circumstances. The vulnerability, tracked as CVE-2024-6386 CVSS score: 9.9, impacts all versions of the plugin before 4.6.13,...

1,000,000 WordPress Sites Protected Against Unique Remote Code Execution Vulnerability in WPML WordPress Plugin

Did you know Wordfence runs a Bug Bounty Program for all WordPress plugin and themes at no cost to vendors? Through October 14th, researchers can earn up to $31,200, for all in-scope vulnerabilities submitted to our Bug Bounty Program! Find a vulnerability, submit the details directly to us, and ...

CVE-2024-6386

The WPML plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.6.12 via Twig Server-Side Template Injection. This is due to missing input validation and sanitization on the render function. This makes it possible for authenticated attackers, with...

Server-Side Template Injection (SSTI)

shopware/core and shopware/platform is vulnerable to Server-Side Template Injection SSTI. The vulnerability is due to improper escaping of the swsilentfeaturecall parameter in Twig templates, allowing execution of code through unescaped feature flag names...

Server-Side Template Injection

shopware/core and shopware/platform is vulnerable to Server-Side Template Injection. The vulnerability is due to improper handling of the context variable in Twig templates, allowing attackers with Administration access to execute arbitrary PHP functions or methods...

CVE-2024-42356 Shopware vulnerable to Server Side Template Injection in Twig using Context functions

Shopware is an open commerce platform. Prior to versions 6.6.5.1 and 6.5.8.13, the context variable is injected into almost any Twig Template and allows to access to current language, currency information. The context object allows also to switch for a short time the scope of the Context as a...