CVE-2023-29827

ejs v3.1.9 is vulnerable to server-side template injection. If the ejs file is controllable, template injection can be implemented through the configuration settings of the closeDelimiter parameter. NOTE: this is disputed by the vendor because the render function is not intended to be used with...

Server-side template injection in beetl

An issue in the render function of beetl v3.15.0 allows attackers to execute server-side template injection SSTI via a crafted payload...

CVE-2023-30331

An issue in the render function of beetl v3.15.0 allows attackers to execute server-side template injection SSTI via a crafted payload...

Sql injection

An issue in the render function of beetl v3.15.0 allows attackers to execute server-side template injection SSTI via a crafted payload...

CVE-2023-29827

ejs v3.1.9 is vulnerable to server-side template injection. If the ejs file is controllable, template injection can be implemented through the configuration settings of the closeDelimiter parameter. NOTE: this is disputed by the vendor because the render function is not intended to be used with...

CVE-2023-29827: Improper Neutralization of Special Elements in Output Used by a Downstream Component

ejs v3.1.9 is vulnerable to server-side template injection. If the ejs file is controllable, template injection can be implemented through the configuration settings of the closeDelimiter parameter. NOTE: this is disputed by the vendor because the render function is not intended to be used with...

CVE-2023-30331

An issue in the render function of beetl v3.15.0 allows attackers to execute server-side template injection SSTI via a crafted payload...

CVE-2023-30331

An issue in the render function of beetl v3.15.0 allows attackers to execute server-side template injection SSTI via a crafted payload...

CVE-2023-29827

ejs v3.1.9 is vulnerable to server-side template injection. If the ejs file is controllable, template injection can be implemented through the configuration settings of the closeDelimiter parameter. NOTE: this is disputed by the vendor because the render function is not intended to be used with...

CVE-2023-30331

An issue in the render function of beetl v3.15.0 allows attackers to execute server-side template injection SSTI via a crafted payload...

CVE-2023-30331

CVE-2023-30331 affects Beetl v3.15.0 where the render function is vulnerable to server-side template injection (SSTI). The root cause is insufficient checks in the render path, enabling a crafted payload to execute code on the server. The issue is rated CRITICAL (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U...

CVE-2023-30331: Undefined Security Weakness

An issue in the render function of beetl v3.15.0 allows attackers to execute server-side template injection SSTI via a crafted payload...

CVE-2023-26546

European Chemicals Agency IUCLID before 6.27.6 allows remote authenticated users to execute arbitrary code via Server Side Template Injection SSTI with a crafted template file. The attacker must have template manager permission...

Sql injection

European Chemicals Agency IUCLID before 6.27.6 allows remote authenticated users to execute arbitrary code via Server Side Template Injection SSTI with a crafted template file. The attacker must have template manager permission...

CVE-2023-26546: Improper Control of Generation of Code

European Chemicals Agency IUCLID before 6.27.6 allows remote authenticated users to execute arbitrary code via Server Side Template Injection SSTI with a crafted template file. The attacker must have template manager permission...

CVE-2023-26546

European Chemicals Agency IUCLID before 6.27.6 allows remote authenticated users to execute arbitrary code via Server Side Template Injection SSTI with a crafted template file. The attacker must have template manager permission...

Remote Code Execution (RCE)

Strapi is vulnerable to Remote Code Execution. A remote attacker can exploit a Server-Side Template Injection that modifies email templates, which allows an attacker to craft a payload through the modified template that executes arbitrary code on the server...

GHSA-2H87-4Q2W-V4HF Strapi plugins vulnerable to Server-Side Template Injection and Remote Code Execution in the Users-Permissions Plugin

Summary Strapi through 4.5.5 allows authenticated Server-Side Template Injection SSTI that can be exploited to execute arbitrary code on the server. Details Strapi through 4.5.5 allows authenticated Server-Side Template Injection SSTI that can be exploited to execute arbitrary code on the server....

Strapi plugins vulnerable to Server-Side Template Injection and Remote Code Execution in the Users-Permissions Plugin

Summary Strapi through 4.5.5 allows authenticated Server-Side Template Injection SSTI that can be exploited to execute arbitrary code on the server. Details Strapi through 4.5.5 allows authenticated Server-Side Template Injection SSTI that can be exploited to execute arbitrary code on the server....

Design/Logic Flaw

Strapi through 4.5.5 allows authenticated Server-Side Template Injection SSTI that can be exploited to execute arbitrary code on the server. A remote attacker with access to the Strapi admin panel can inject a crafted payload that executes code on the server into an email template that bypasses t...