872 matches found
CVE-2018-13818
Twig before 2.4.4 allows Server-Side Template Injection SSTI via the search searchkey parameter. NOTE: the vendor points out that Twig itself is not a web application and states that it is the responsibility of web applications using Twig to properly wrap input to it...
CVE-2018-13818
Twig before 2.4.4 allows Server-Side Template Injection SSTI via the search searchkey parameter. NOTE: the vendor points out that Twig itself is not a web application and states that it is the responsibility of web applications using Twig to properly wrap input to it...
CVE-2018-13818
Twig before 2.4.4 is vulnerable to Server-Side Template Injection (SSTI) via the search_key parameter. The issue is caused by how Twig interprets the token value. Affected software is Twig versions prior to 2.4.4; remediation is to upgrade to 2.4.4 or later, or to properly wrap/validate input in ...
CVE-2018-7663
An issue was discovered in resources/views/layouts/app.blade.php in Voten.co before 2017-08-25. An unescaped template literal in the bio field of a user profile resources/views/layouts/app.blade.php allows for server-side template injection of arbitrary JavaScript...
CVE-2018-7663
CVE-2018-7663 concerns Voten.co before 2017-08-25, where an unescaped template literal in the bio field of a user profile (in resources/views/layouts/app.blade.php) enables server-side template injection of arbitrary JavaScript. Multiple sources (NVD/NVD-derived records, CNVD) confirm the issue a...
Twig 2.4.4 - Server Side Template Injection
Twig 2.4.4 - Server Side Template Injection Vulnerability details: Exploit Title: Twig Output: 16 2. POC: http://localhost/search?searchkey=44 OUTPUT: 4 http://localhost/search?searchkey=ls OUTPUT: list of files/directories etc…...
Twig Server Side Template Injection
Vulnerability details: Exploit Title: Twig Output: 16 2. POC: http://localhost/search?searchkey=44 OUTPUT: 4 http://localhost/search?searchkey=ls OUTPUT: list of files/directories etca|...
HubSpot: Reflected XSS and Server Side Template Injection in all HubSpot CMSes
Really I don't know why BugCrowd team closed my submission as N/A F337815 They mentioned that Not in Scope ?! So I reported it again in another submission But this Time I messaged the Security Company Directly and triaged and Fixed in 2 Days . Full Poc : I was found in this path /hcms/cta so this...
Sql injection
In CMS Made Simple 2.1.6, there is Server-Side Template Injection via the cntnt01detailtemplate parameter...
CVE-2017-16783
In CMS Made Simple 2.1.6, there is Server-Side Template Injection via the cntnt01detailtemplate parameter...
CVE-2017-16783
CMS Made Simple 2.1.6 is affected by CVE-2017-16783: a Server-Side Template Injection issue exploited via the cntnt01detailtemplate parameter. Public references (NVD and exploit databases) describe a high-severity vulnerability with authenticated-free, network-exposed exploitation and impact to c...