EUVD-2026-93772

LiquidJS: ownPropertyOnly bypass for inherited array indices in first/last/join/reverse/slice/compact, .first/.last, negative index, and for-loop iteration...

Nodejs Squirrelly - Remote Code Execution

Nodejs Squirrelly is susceptible to remote code execution. Squirrelly is a template engine implemented in JavaScript that works out of the box with ExpressJS. Squirrelly mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuratio...

CVE-2026-67273

Dell Container Storage Modules, versions prior to 1.18.0, contains an Improper Neutralization of Special Elements Used in a Template Engine vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges...

EUVD-2026-93457

Dell Container Storage Modules, versions prior to 1.18.0, contains an Improper Neutralization of Special Elements Used in a Template Engine vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges...

CVE-2026-67273

Dell Container Storage Modules (CSM) , versions prior to 1.18.0 , are vulnerable to an Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336). A low-privileged attacker with remote access can exploit this flaw to achieve Elevation of Privileges , access sensitive informa...

CVE-2026-67273

Dell Container Storage Modules, versions prior to 1.18.0, contains an Improper Neutralization of Special Elements Used in a Template Engine vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges...

CVE-2026-75650

abraxaslabs.tech · github.com/abraxas · @abraxasnull · CVE-2026-75650 CVE-2026-75650 Magento Open Source 2.4.8-p5 — Adobe Adobe Commerce 受到“模板引擎中使用的特殊元素未正确中和”漏洞影响，该漏洞可能导致在当前用户上下文中执行任意代码。 | ---|--- CVE| CVE-2026-75650 · CVE.org CWE| CWE-1336 CVSS| 严重：10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A...

CVE-2021-32819

CVE-2021-32819 CVE-2021-32819 : SquirrellyJS 通过 Express 渲染 API 将纯模板数据与引擎配置选项混合在一起。通过覆盖内部配置选项，可能在下游应用程序中触发远程代码执行。 来源 https://securitylab.github.com/advisories/GHSL-2021-023-squirrelly/ 分析 https://blog.diefunction.io/vulnerabilities/ghsl-2021-023 squirrelly v8.0.0 = v8.0.8 远程代码执行 环境 Ubuntu 20.04.1 ...

CVE-2022-29078

CVE-2022-29078 | EJS SSTI → RCE White Hat School 第4期 32班 - 우상범 @taka3636 摘要 EJS Hello 这样，通过在 HTML 中嵌入 标签插入 JavaScript 来生成动态页面。在内部，EJS 会将模板字符串编译为 JavaScript 函数 ，然后执行该函数生成最终的 HTML。也就是说，它是一个"将文字模板转换为可执行代码函数"的代码生成器，这一特性正是本漏洞的根本背景。 CVE-2022-29078 介绍 EJS 3.1.7 会将渲染选项 outputFunctionName...

CVE-2026-90970 Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway

GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1 that, under certain conditions, could have allowed an authenticated user with Duo Agent Platform access to escape...

OTE

OSINT Template Engine OSINT Template Engine is an experimental tool for OSINT Information gathering & Attack Surface Mapping which uses customizable templates to collect data from sources. It allows for new template creation and modification of existing ones which gives it a competitive advantage...

PoC-CVE-2024-33883

CVE-2024-33883 [email protected]，原型污染验证不足导致RCE利用 利用原型污染，将opts.client设置为真值（条件） 然后，当render运行时，ejs会将opts.escapeFunction的值作为JS代码执行。 漏洞代码范围 基于[email protected] 1. ejs/lib/ejs.js - line 580, 636, 637 PoC（注入webshell并激活） 1. GET /pollute?target=client&value=1 2. GET...

CVE-2026-103540 formtools.org Form Tools Client Settings Clients.class.php updateClientSettingsTab special elements in template engine

A security vulnerability has been detected in formtools.org Form Tools up to 3.1.1. This vulnerability affects the function Clients::updateClientSettingsTab of the file global/code/Clients.class.php of the component Client Settings. The manipulation of the argument pagetitles leads to improper...

EUVD-2026-90497

A security vulnerability has been detected in formtools.org Form Tools up to 3.1.1. This vulnerability affects the function Clients::updateClientSettingsTab of the file global/code/Clients.class.php of the component Client Settings. The manipulation of the argument pagetitles leads to improper...

CVE-2026-103540 formtools.org Form Tools Client Settings Clients.class.php updateClientSettingsTab special elements in template engine

A security vulnerability has been detected in formtools.org Form Tools up to 3.1.1. This vulnerability affects the function Clients::updateClientSettingsTab of the file global/code/Clients.class.php of the component Client Settings. The manipulation of the argument pagetitles leads to improper...

CVE-2026-103540: Improper Neutralization of Special Elements Used in a Template Engine

A security vulnerability has been detected in formtools.org Form Tools up to 3.1.1. This vulnerability affects the function Clients::updateClientSettingsTab of the file global/code/Clients.class.php of the component Client Settings. The manipulation of the argument pagetitles leads to improper...

CVE-2026-102142

A system notification template on the Kiteworks appliance was rendered by a template engine that evaluated expressions contained in the stored template body. An authenticated System Administrator could potentially store a crafted template that executed operating-system commands on the appliance...

PT-2026-103575

Name of the Vulnerable Software and Affected Versions Kiteworks appliance affected versions not specified Description A system notification template on the Kiteworks appliance is processed by a template engine that evaluates expressions within the stored template body. This allows an authenticate...

CVE-2026-102142: Improper Neutralization of Special Elements Used in a Template Engine

A system notification template on the Kiteworks appliance was rendered by a template engine that evaluated expressions contained in the stored template body. An authenticated System Administrator could potentially store a crafted template that executed operating-system commands on the appliance...

CVE-2026-102771 Naichen ThinkCMF Email Template MailController.php templatePut special elements in template engine

A security vulnerability has been detected in Naichen ThinkCMF up to 8.0.7. Affected by this issue is the function MailController::templatePut of the file cmf-api/src/admin/controller/MailController.php of the component Email Template. The manipulation leads to improper neutralization of special...