864 matches found
CVE-2025-66434
An SSTI Server-Side Template Injection vulnerability exists in the getdunninglettertext method of Frappe ERPNext through 15.89.0. The function renders attacker-controlled Jinja2 templates bodytext using frappe.rendertemplate with a user-supplied context doc. Although Frappe uses a custom...
CVE-2024-58293
CVE-2024-58293 affects Akaunting 3.1.8 with a server-side template injection vulnerability. Authenticated administrators can inject template expressions into multiple form fields (items, taxes, transactions, vendor name), enabling arithmetic operations and string manipulations. Public sources in ...
Grav is vulnerable to Server-Side Template Injection (SSTI) via Forms
Summary Having a simple form on site can reveal the whole Grav configuration details including plugin configuration details by using the correct POST payload. Sensitive information may be contained in the configuration details. PoC Create a simple form with two fields, 'registration-number' and...
GHSA-662M-56V4-3R8F Grav is vulnerable to RCE via SSTI through Twig Sandbox Bypass
Summary A Server-Side Template Injection SSTI vulnerability exists in Grav that allows authenticated attackers with editor permissions to execute arbitrary commands on the server and, under certain conditions, may also be exploited by unauthenticated attackers. This vulnerability stems from weak...
EUVD-2025-200111
Grav is Vulnerable to Security Sandbox Bypass with SSTI Server Side Template Injection...
Grav is Vulnerable to Security Sandbox Bypass with SSTI (Server Side Template Injection)
Summary Grav CMS is vulnerable to a Server-Side Template Injection SSTI that allows any authenticated user with editor permissions to execute arbitrary code on the remote server, bypassing the existing security sandbox. Details Grav CMS uses a custom sandbox to protect the powerful Twig methods...
CVE-2025-66299
Grav CMS is vulnerable to a Server-Side Template Injection (SSTI) that lets an authenticated editor execute arbitrary code on the server by abusing the Twig sandbox, bypassing restrictions via crafted Twig directives to modify system.twig.safe_filters. The issue exists prior to Grav 1.8.0-beta.27...
CVE-2025-66298 Grav is vulnerable to Server-Side Template Injection (SSTI) via Forms
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, having a simple form on site can reveal the whole Grav configuration details including plugin configuration details by using the correct POST payload to exploit a Server-Side Template SST vulnerability. Sensitive information may be...
CVE-2025-66294
CVE-2025-66294 affects Grav CMS. A Server-Side Template Injection (SSTI) exists due to weak regex validation in the core method cleanDangerousTwig, enabling an authenticated editor to trigger arbitrary commands on the server; in some cases, unauthenticated exploitation is possible. Public materia...
Grav CMS Twig SSTI Authenticated Sandbox Bypass RCE
This module exploits a Server-Side Template Injection SSTI vulnerability CVE-2025-66294 in Grav CMS that allows bypassing the Twig sandbox to achieve remote code execution. The cleanDangerousTwig method uses weak regex that fails to sanitize nested Twig calls within the evaluatetwig function. To...
Exploit for CVE-2025-64087
CVE-2025-64087 SSTI FreeMarker Server-Side Template Injec...
Server-Side Template Injection
github.com/lxc/lxd is vulnerable to Server-Side Template Injection SSTI. The vulnerability is due to improper handling of snapshot pattern templates using the Pongo2 template engine, which allows an attacker with instance-configuration permissions to craft malicious templates and read arbitrary...
GHSA-527Q-4WQV-G9WJ bagisto has Server Side Template Injection (SSTI) in Product Description
Summary Bagisto v2.3.7 is vulnerable to Server-Side Template Injection SSTI due to unsanitized user input being processed by the server-side templating engine when rendering product descriptions. This allows an attacker with product creation privileges to inject arbitrary template expressions tha...
EUVD-2020-0435
Malware in sbrugna...
EUVD-2019-6057
Malware in sbrugna...
EUVD-2019-10958
Malware in sbrugna...
EUVD-2020-0549
Malware in sbrugna...
EUVD-2021-22092
Malware in sbrugna...