CVE-2026-104073 NetBox 2.9.5 < 4.7.0 Session Hijacking via Custom Links

NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can add custom links" permission to steal session cookies and API tokens of other users by exposing the raw Django HttpRequest object to the Jinja2 template contex...

CVE-2026-104073 NetBox 2.9.5 < 4.7.0 Session Hijacking via Custom Links

NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can add custom links" permission to steal session cookies and API tokens of other users by exposing the raw Django HttpRequest object to the Jinja2 template contex...

CVE-2022-40634

CVE-2022-40634: CrafterCMS 中的 FreeMarker 服务端模板注入 通过在 FTL 模板中插入恶意内容，攻击者可能执行 SSTI（服务端模板注入）攻击，从而利用 FreeMarker 暴露的对象绕过限制并获取 RCE（远程代码执行）。 厂商披露： 厂商对该漏洞的披露和修复可参见此处。 利用条件： 此漏洞需要： 有效的用户凭据 概念验证： 更多详情及利用过程可参见此 PDF。 附加资源： 最初由 Alvaro "pwntester" Munoz 发现的 漏洞 CVE-2020-25803 及 博客文章 启发了本漏洞的 SSTI 研究和发现。...

CVE-2022-25813

CVE-2022-25813: Apache OfBiz中的FreeMarker服务端模板注入 通过在消息的“主题”字段中插入恶意内容，攻击者可以进行SSTI（服务端模板注入）攻击，利用FreeMarker暴露的对象绕过限制并获得RCE（远程代码执行）。 注意： 虽然此漏洞需要合法用户的交互才能触发SSTI，但任何创建了电子商务账户的未认证攻击者都可以发送恶意载荷。 厂商披露： 厂商关于此漏洞的披露和修复可在此处找到here。 需求： 此漏洞需要： 注册新用户或拥有有效用户凭证 管理员用户的交互 概念验证： 更多细节和利用过程可在本PDF中找到。 其他资源： 由Alvaro...

OPENSUSE-SU-2026:22028-1 Security update for python-fsspec

This update for python-fsspec fixes the following issues: Changes in python-fsspec: - CVE-2026-104851: python-fsspec: remote code execution via server-side template injection in ReferenceFileSystem bsc1284173...

Security Bulletin: Due to use of QOS.CH logback, IBM Cloud Pak System is affected by server-side request forgery and arbitrary code execution

Summary Due to use of QOS.CH logback IBM Cloud Pak System is affected by server-side request forgery and arbitrary code execution CVE-2024-12801, CVE-2024-12798. Those issues were addressed by IBM Cloud Pak System v2.3.6.2. Vulnerability Details CVEID:CVE-2024-12801 DESCRIPTION: Server-Side Reque...

CVE-2023-49964

CVE-2023-49964：Alfresco 中的 FreeMarker 服务端模板注入 在 Hyland Alfresco Community Edition =7.2.0 中发现了一个问题。通过在 folder.get.html.ftl 文件中插入恶意内容，攻击者可以执行 SSTI（服务端模板注入）攻击，利用 FreeMarker 暴露的对象来绕过限制并实现 RCE（远程代码执行）。 注意： 此问题源于 CVE-2020-12873 的修复不完整。 NVD 披露： 该漏洞的披露信息可在此处找到。 要求： 此漏洞需要： 有效的用户凭据 概念验证： 更多详情和利用过程可在此 PDF...

CVE-2021-40822

CVE-2021-40822 SSRF GeoServer Artículo: https://gccybermonks.com/posts/cve-2021-40822/ Laboratorio: Clona este repositorio: git clone https://github.com/phor3nsic/CVE-2021-40822.git Inicia el laboratorio: cd CVE-2021-40822 && docker-compose up Comprueba si este objetivo es vulnerable: python3...

CLEANSTART-2026-ZF54924 incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs

CVE-2026-46597 affects multiple packages. An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs. See references for individual vulnerability details...

PT-2026-106848

NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can add custom links" permission to steal session cookies and API tokens of other users by exposing the raw Django HttpRequest object to the Jinja2 template contex...

ALSA-2026:77018 Important: python3.14 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution

Summary fsspec.implementations.reference.ReferenceFileSystem parses a "references" JSON document Kerchunk format supplied either inline or via a URL. The parser renders fields from this JSON through un-sandboxed jinja2.Template....render... calls in three locations. An attacker who controls the...

GHSA-27VJ-QCQG-25RC fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution

Summary fsspec.implementations.reference.ReferenceFileSystem parses a "references" JSON document Kerchunk format supplied either inline or via a URL. The parser renders fields from this JSON through un-sandboxed jinja2.Template....render... calls in three locations. An attacker who controls the...

CVE-2026-105438 O2OA General url ActionUploadExcelWithUrl server-side request forgery

A flaw has been found in O2OA up to 10.0.1-ce. This affects the function ActionUploadExcelWithUrl of the file /xgeneralassemblecontrol/jaxrs/excel/upload/with/url of the component General Module. Executing a manipulation of the argument fileUrl can lead to server-side request forgery. The attack...

CVE-2026-105438 O2OA General url ActionUploadExcelWithUrl server-side request forgery

A flaw has been found in O2OA up to 10.0.1-ce. This affects the function ActionUploadExcelWithUrl of the file /xgeneralassemblecontrol/jaxrs/excel/upload/with/url of the component General Module. Executing a manipulation of the argument fileUrl can lead to server-side request forgery. The attack...

CVE-2026-105438

A Server-Side Request Forgery (SSRF) vulnerability exists in O2OA versions up to 10.0.1-ce . The flaw is located in the General Module within the function ActionUploadExcelWithUrl at the file path /x_general_assemble_control/jaxrs/excel/upload/with/url. An attacker can achieve SSRF by manipulatin...

CVE-2026-105438 O2OA General url ActionUploadExcelWithUrl server-side request forgery

A flaw has been found in O2OA up to 10.0.1-ce. This affects the function ActionUploadExcelWithUrl of the file /xgeneralassemblecontrol/jaxrs/excel/upload/with/url of the component General Module. Executing a manipulation of the argument fileUrl can lead to server-side request forgery. The attack...

CVE-2022-46364-Proof-of-the-concept

CVE-2022-46364: Apache CXF MTOM XOP:Include SSRF 到 LFI 利用工具 ⚠️ 免责声明 此工具仅供教育和已授权的安全测试使用 此概念验证利用工具仅用于教育目的，帮助安全专业人员了解该漏洞并保护其系统。未经授权访问计算机系统是违法的。作者对因使用此工具产生的任何误用或损害不承担任何责任。在测试前，您必须获得系统所有者的明确书面许可。使用此工具即表示您同意遵守所有适用法律。 📋 目录 1. 概述 2. 漏洞详情 3. 技术深入剖析 4. 利用工具用法 5. 安装与要求 6. 缓解措施 7. 参考资料与致谢 📌 概述 属性| 值 ---|---...

CVE-2022-26134

CVE-2022-26134 （CVE-2022-26134）一个未经身份验证的远程 OGNL 注入漏洞，可在 Confluence 服务器上下文中导致代码执行 要求：Python2 或 Python3 用法： python cve202226134.py -url targeturl -cmd "ls -al" python cve202226134.py -url targeturl -cmd "whoami" 如果目标是 Windows 系统，请按如下方式使用脚本，例如： python3 cve202226134.py -url targeturl -cmd "cmd /c...

CVE-2026-102777

Joomla Extension - svenbluege.de - Server-side request forgery in the Google Photos picker in Event Gallery extension 6.6.0 - The Google Photos picker of the back-end upload page fetches the thumbnails of the picked images through the server, with the OAuth access token of the Google Photos...