Webkul Software Bagisto 安全漏洞

Webkul Software Bagisto is an open source e-commerce framework from Webkul Software India. A security vulnerability exists in Webkul Software Bagisto versions prior to 2.3.10, which stems from server-side template injection and could lead to remote code execution...

Webkul Software Bagisto 安全漏洞

Webkul Software Bagisto is an open source e-commerce framework from Webkul Software India. A security vulnerability exists in Webkul Software Bagisto versions prior to 2.3.10, which stems from server-side template injection and could lead to remote code execution...

PT-2026-1129

Name of the Vulnerable Software and Affected Versions Bagisto versions prior to 2.3.10 Description Bagisto, an open source Laravel eCommerce platform, has a server-side template injection issue. This issue occurs through the first name and last name fields submitted by a low-privilege user. The...

PT-2026-1130

Name of the Vulnerable Software and Affected Versions Bagisto versions prior to 2.3.10 Description Bagisto, an open source Laravel eCommerce platform, is susceptible to server-side template injection through the type parameter. This can potentially lead to remote code execution. Recommendations...

CVE-2025-68929 Frappe may be vulnerable remote code execution due to server-side template injection

Frappe is a full-stack web application framework. Prior to versions 14.99.6 and 15.88.1, an authenticated user with specific permissions could be tricked into accessing a specially crafted link. This could lead to a malicious template being executed on the server, resulting in remote code...

CVE-2025-68929 Frappe may be vulnerable remote code execution due to server-side template injection

Frappe is a full-stack web application framework. Prior to versions 14.99.6 and 15.88.1, an authenticated user with specific permissions could be tricked into accessing a specially crafted link. This could lead to a malicious template being executed on the server, resulting in remote code...

VulnCheck KEV: CVE-2025-49619

Skyvern through 0.1.85 is vulnerable to server-side template injection SSTI in the Prompt field of workflow blocks such as the Navigation v2 Block. Improper sanitization of Jinja2 template input allows authenticated users to inject crafted expressions that are evaluated on the server, leading to...

📄 Crafty Controller 4.6.1 Remote Code Execution / Server-Side Template Injection

Crafty Controller version 4.6.1 allows authenticated remote attackers to execute arbitrary system commands on the target server through server-side template injection the webhook configuration feature...

CVE-2025-67843

A Server-Side Template Injection SSTI vulnerability in the MDX Rendering Engine in Mintlify Platform before 2025-11-15 allows remote attackers to execute arbitrary code via inline JSX expressions in an MDX file...

CVE-2025-67843

Mintlify Platform is affected by a Server-Side Template Injection (SSTI) in its MDX Rendering Engine prior to 2025-11-15. The vulnerability allows remote attackers to execute arbitrary code via inline JSX expressions in an MDX file. Affected component: MDX Rendering Engine in Mintlify Platform (p...

EUVD-2025-204427

A Server-Side Template Injection SSTI vulnerability in the MDX Rendering Engine in Mintlify Platform before 2025-11-15 allows remote attackers to execute arbitrary code via inline JSX expressions in an MDX file...

CVE-2025-14700

An input neutralization vulnerability in the Webhook Template component of Crafty Controller allows a remote, authenticated attacker to perform remote code execution via Server Side Template Injection...

PT-2025-52404

Name of the Vulnerable Software and Affected Versions Mintlify Platform versions prior to 2025-11-15 Description A Server-Side Template Injection SSTI flaw exists in the MDX Rendering Engine of Mintlify Platform. This issue allows remote attackers to execute arbitrary code through inline JSX...

CVE-2022-23851

Netaxis API Orchestrator APIO before 0.19.3 allows server side template injection SSTI...

CVE-2022-23851

Netaxis API Orchestrator APIO before 0.19.3 allows server side template injection SSTI...

CVE-2025-14700

An input neutralization vulnerability in the Webhook Template component of Crafty Controller allows a remote, authenticated attacker to perform remote code execution via Server Side Template Injection...

CVE-2025-14700 Improper Neutralization of Special Elements Used in a Template Engine in Crafty Controller

An input neutralization vulnerability in the Webhook Template component of Crafty Controller allows a remote, authenticated attacker to perform remote code execution via Server Side Template Injection...

CVE-2025-14700

CVE-2025-14700 affects Crafty Controller 4.6.1 in the Webhook Template component. The supplied documents describe an input neutralization vulnerability that enables authenticated attackers to achieve remote code execution via Server-Side Template Injection (SSTI). Multiple sources (NVD/Red Hat/CV...

CVE-2022-23851

Netaxis API Orchestrator APIO before 0.19.3 allows server side template injection SSTI...

CVE-2022-23851

CVE-2022-23851 affects Netaxis API Orchestrator (APIO) up to version 0.19.3 (pre-0.19.3). The vulnerability is a server-side template injection (SSTI) flaw that can impact confidentiality, integrity, and availability (CVSS v3.1 base score 9.8). Some sources note that this issue could potentially ...