OpenCATS - Open Redirect

OpenCATS contains an open redirect vulnerability due to improper validation of user-supplied GET parameters. This, in turn, exposes OpenCATS to possible template injection and obtaining sensitive information, modifying data, and/or executing unauthorized operations. id: CVE-2023-27292 info: name:...

OpenAM<=15.0.3 FreeMarker - Template Injection

OpenAM is an open access management solution. In versions 15.0.3 and prior, the getCustomLoginUrlTemplate method in RealmOAuth2ProviderSettings.java is vulnerable to template injection due to its usage of user input id: CVE-2024-41667 info: name: OpenAM=15.0.3 FreeMarker - Template Injection...

JeecgBoot JimuReport - Template injection

A vulnerability was found in jeecgboot JimuReport up to 1.6.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Template Handler. The manipulation leads to injection. The attack can be launched remotely. The exploit has been disclosed t...

XWiki <= 17.3.0 - Server-Side Template Injection (SSTI)

XWiki = 17.3.0 contains a server-side template injection caused by improper validation of Apache Velocity template code in the Administration interface HTTP Meta Info field, letting authenticated administrators execute arbitrary template logic. id: CVE-2025-51991 info: name: XWiki = 17.3.0 -...

Tutor LMS < 4.0.6 - Unauthenticated Arbitrary PHP Function Invocation

Tutor LMS WordPress plugin 4.0.6 contains a template injection caused by insufficient prevention of request data overwriting internal variables during template rendering, letting unauthenticated attackers invoke arbitrary zero-argument PHP functions and receive their output. id: CVE-2026-19092...

Node.js Embedded JavaScript 3.1.6 - Template Injection

Node.js Embedded JavaScript 3.1.6 is susceptible to server-side template injection via settingsview optionsoutputFunctionName, which is parsed as an internal option and overwrites the outputFunctionName option with an arbitrary OS command, which is then executed upon template compilation. id:...

PHPCMS 2008 - Remote Code Execution via Template Injection

PHPCMS 2008 suffers from an unauthenticated RCE via template injection in type.php, where attacker-supplied content is written into a PHP template cache file, which is then executable. id: CVE-2018-19127 info: name: PHPCMS 2008 - Remote Code Execution via Template Injection author: tomaquet18...

spring-cloud-netflix-hystrix-dashboard-cve-2021-22053

CVE-2021-22053: Spring Cloud Netflix Hystrix Dashboard template resolution vulnerability Severity High Vendor Spring by VMware Description Applications using both spring-cloud-netflix-hystrix-dashboard and spring-boot-starter-thymeleaf expose a way to execute code submitted within the request URI...

CVE-2022-24086

CVE-2022-24086 PoC of CVE-2022-24086 root@kitploit: var this.getTemplateFilter.addAfterFilterCallback"system".filter"whoami"...

CVE-2024-23692

CVE-2024-23692 Burp 概念验证（POC） root@kitploit: GET /?n=%0A&cmd=ipconfig+/all&search=%25xxx%25url:%password%.exec|.?cmd.|timeout=15|out=abc..?n..?n.RESULT:.?n..^abc.====.?n. HTTP/1.1 Host: xxxx User-Agent: Mozilla/5.0 X11; Linux x8664; rv:109.0 Gecko/20100101 Firefox/115.0 Accept:...

CVE-2025-6335

Title: Template injection command execution vulnerability in dedeCMS 5.7 sp2 BUGAuthor: Ewoji Affected Version: dedeCMS 5.7.2 Vendor: Shanghai Zhuozhuo Network Technology Co., LTD Software: dedeCMS Vulnerability Files: /include/dedetag.class.php Description: 1. After install，Log in to the...

CVE-2022-22954

CVE-2022-22954 注意 请自行承担使用风险。本仓库仅用于教育目的，我们坚决反对一切非法意图，并且不对与本仓库相关的任何非法活动负责。请遵守道德规范！ 示例 root@kitploit: python3 CVE-2022-22954.py -t target.com python3 CVE-2022-22954.py -t 10.10.10.10 Shodan 查询 root@kitploit: shodan search "http.favicon.hash:-1250474341" --limit 1000 Bash 单行命令 root@kitploit: cat...

CVE-2024-40111-Exploit

CVE-2024-40111: Stored Cross-Site Scripting XSS in Automad 2.0.0-alpha.4 Exploit Details Exploit Title : Stored Cross-Site Scripting XSS in Automad 2.0.0-alpha.4 Date : 2024-06-20 Exploit Author : Jerry Thomas w3bn00b3r Vendor Homepage : Automad Software Link : Automad GitHub Repository Category ...

jinjava-cve-2026-25526-poc

Exploit paso a paso los 9 pasos: mvn exec:java -Dexec.mainClass=ExploitHarness -q 2. Cadenas de exploit finales creación de archivos, lectura de archivos, divulgación de información: mvn exec:java -Dexec.mainClass=ExploitFinal -q 3. Exfiltración de contenido de archivos lee /etc/passwd,...

CVE-2023-22527

CVE-2023-22527 Este repositorio presenta una prueba de concepto de CVE-2023-22527 CVE-2023-22527 | RCE usando SSTI en Confluence Aviso legal Este código es una prueba de concepto de la vulnerabilidad; no animo a nadie a usarlo en instancias de Confluence que no sean de su propiedad. Esta...

CVE-2023-22527-POC

CVE-2023-22527 &color=brighgreen%3E Descripción Una vulnerabilidad de inyección de plantillas en versiones antiguas de Confluence Data Center y Server permite a un atacante no autenticado lograr RCE en una instancia afectada. Los clientes que utilicen una versión afectada deben tomar medidas...

CVE-2026-25731

Inyección de Plantillas del Lado del Servidor SSTI en el Motor Templite Gravedad: Alta CVSS 7.8 Software afectado: calibre Corregido en: 9.2.0 Aviso: GHSA-xrh9-w7qx-3gcc Resumen Una vulnerabilidad de Inyección de Plantillas del Lado del Servidor SSTI en el motor de plantillas Templite de Calibre...

cve-2026-4257

CVE-2026-4257 此漏洞利用 CVE-2026-4257，这是 Supsystic 开发的 "Contact Form" WordPress 插件 1.7.36 及之前版本中的一个服务器端模板注入（SSTI）漏洞。该漏洞允许未经身份验证的攻击者实现远程代码执行。 该漏洞存在于 formsViewCfs 类的 generateHtml 函数中，该函数通过任意一个适当类型的联系表单字段参数接收用户控制的输入。 已在 Ubuntu 24.04 和 Contact Form by Supsystic 1.7.36 版本上测试 Python 脚本选项 关于模块文档，请参见...

CVE-2026-34724

🚨 CVE-2026-34724 - Zammad 7.0.1 - 通过AI代理的服务器端模板注入（SSTI）导致远程代码执行（RCE） 📌 概述 Zammad 是一个流行的开源基于 Web 的帮助台和客户支持系统。 CVE-2026-34724 是新的 AI Agent 功能中的一个 服务器端模板注入（SSTI） 漏洞。 一个能够修改 typeenrichmentdata 配置的已认证 管理员 可以注入恶意模板，当 AI 代理处理数据时导致 完全远程代码执行（RCE） 。 受影响版本 ：Zammad 7.0.1 修复版本 ：Zammad 7.0.1 （于 2026 年 4 月 8 日发...

phishery

phishery Phishery 是一个简单的启用了SSL的HTTP服务器，主要目的是通过基本认证（Basic Authentication）钓鱼获取凭证。Phishery 还提供了将URL轻松注入到.docx Word文档中的能力。 phishery 的强大之处最好地体现在：将Word文档的模板设置为phishery URL，会导致Microsoft Word向该URL发出请求，从而向最终用户显示一个认证对话框。使用phishery的-i 输入docx、-o 输出docx和-u url选项，可以将任何.docx文件注入URL。 下载 操作系统特定的包可以从以下链接下载。 安装...