Remote code execution

A Server-Side Template Injection SSTI was discovered in Form.io 2.0.0. This leads to Remote Code Execution during deletion of the default Email template URL...

CVE-2020-28246

A Server-Side Template Injection SSTI was discovered in Form.io 2.0.0. This leads to Remote Code Execution during deletion of the default Email template URL. NOTE: the email templating service was removed after 2020. Additionally, the vendor disputes this issue indicating this is sandboxed and on...

CVE-2020-28246

A Server-Side Template Injection SSTI was discovered in Form.io 2.0.0. This leads to Remote Code Execution during deletion of the default Email template URL. NOTE: the email templating service was removed after 2020. Additionally, the vendor disputes this issue indicating this is sandboxed and on...

CVE-2020-28246

CVE-2020-28246 describes a Server-Side Template Injection (SSTI) in Form.io 2.0.0 that leads to Remote Code Execution during the deletion of the default Email template URL. The vulnerability stems from the SSTI in the templating flow; the email templating service was removed after 2020, and Form....

GHSA-23Q7-59JJ-2PJ4 SEOmatic for CraftCMS allows Server-Side Template Injection

In the SEOmatic plugin before 3.2.49 for Craft CMS, helpers/DynamicMeta.php does not properly sanitize the URL. This leads to Server-Side Template Injection and credentials disclosure via a crafted Twig template after a semicolon...

SEOmatic for CraftCMS allows Server-Side Template Injection

In the SEOmatic plugin before 3.2.49 for Craft CMS, helpers/DynamicMeta.php does not properly sanitize the URL. This leads to Server-Side Template Injection and credentials disclosure via a crafted Twig template after a semicolon...

SEOmatic for CraftCMS allows Server-Side Template Injection

The Seomatic component before 3.2.46 for Craft CMS allows Server-Side Template Injection and information disclosure via malformed data to the metacontainers controller...

GHSA-6Q4J-8PJM-5MGC SEOmatic for CraftCMS allows Server-Side Template Injection

The Seomatic component before 3.2.46 for Craft CMS allows Server-Side Template Injection and information disclosure via malformed data to the metacontainers controller...

GHSA-J7FX-V37J-V3W7 Craft CMS Vulnerable to Server-Side Template Injection

Craft CMS through 3.0.34 allows remote authenticated administrators to read sensitive information via server-side template injection, as demonstrated by a % string for craft.app.config.DB.user and craft.app.config.DB.password in the URI Format of the Site Settings, which causes a cleartext userna...

Craft CMS Vulnerable to Server-Side Template Injection

Craft CMS through 3.0.34 allows remote authenticated administrators to read sensitive information via server-side template injection, as demonstrated by a % string for craft.app.config.DB.user and craft.app.config.DB.password in the URI Format of the Site Settings, which causes a cleartext userna...

SEOmatic plugin for Craft CMS SSTI Vulnerability

A Server Side Template Injection SSTI was discovered in the SEOmatic plugin before 3.1.4 for Craft CMS, because requests that don't match any elements incorrectly generate the canonicalUrl, and can lead to execution of Twig code...

Sql injection

A Server Side Template Injection SSTI vulnerability in Pentest-Collaboration-Framework v1.0.8 allows an authenticated remote attacker to execute arbitrary code through /project/PROJECTNAME/reports/...

CVE-2021-42651

CVE-2021-42651 describes a Server Side Template Injection (SSTI) in the open-source toolkit Pentest-Collaboration-Framework v1.0.8 . The vulnerability allows an authenticated remote attacker to execute arbitrary code via the path “/project/PROJECTNAME/reports/”. Root cause is SSTI in the server-s...

CVE-2022-29078

A Command injection attack was found in ejs Embedded JavaScript templates for Node.js, which allows an attacker to execute server-side template injection in settingsview optionsoutputFunctionName. This is parsed as an internal option and overwrites the outputFunctionName option with an arbitrary ...

CVE-2022-29078

The ejs aka Embedded JavaScript templates package 3.1.6 for Node.js allows server-side template injection in settingsview optionsoutputFunctionName. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command which is executed upon template...

Exploit for Code Injection in Vmware Identity_Manager

CVE-2022-22954-Testi CVE-2022-22954 Açığı test etme VMware Wo...

Code Injection in Bolt CMS

Bolt CMS = 4.2 is vulnerable to Remote Code Execution. Unsafe theme rendering allows an authenticated attacker to edit theme to inject server-side template injection that leads to remote code execution...

GHSA-GPRH-7767-CW39 Code Injection in Bolt CMS

Bolt CMS = 4.2 is vulnerable to Remote Code Execution. Unsafe theme rendering allows an authenticated attacker to edit theme to inject server-side template injection that leads to remote code execution...

CVE-2022-22954

VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A malicious actor with network access can trigger a server-side template injection that may result in remote code execution...

Remote code execution

VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A malicious actor with network access can trigger a server-side template injection that may result in remote code execution...