18628 matches found
CVE-2026-13297: Improper Neutralization of Special Elements Used in a Template Engine
IBM Verify Identity Access Advanced Access Control may be vulnerable to an information disclosure attack...
PT-2026-86916
Name of the Vulnerable Software and Affected Versions Adobe Commerce versions 2.4.4 through 2.4.9-2026-aug Magento Open Source versions 2.4.4 through 2.4.9-2026-aug Adobe Commerce B2B versions 1.3.3 through 1.5.3-2026-aug Description Adobe Commerce, Magento Open Source, and Adobe Commerce B2B are...
EUVD-2026-71608
In DocsGPT 0.15.0 and below, the application provides a custom prompt feature that allows users to define prompt content used during chatbot interactions. This functionality renders user-supplied prompt data using Jinja templates without input sanitization or sandboxing. An unauthenticated attack...
PT-2026-85397
The Divi Ajax Filter plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.1.2 via the 'custom loop template' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing...
html/template: golang: Go html/template: Cross-Site Scripting via pathological input
A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...
html/template: golang: Go html/template: Cross-Site Scripting via pathological input
A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...
gitpython: GitPython: Remote Code Execution via malicious Git hooks
A flaw was found in GitPython. This vulnerability allows a remote attacker to achieve arbitrary code execution. By supplying a specially crafted template parameter to the Repo.init function, an attacker can point to a directory containing malicious Git hooks. When Git operations are performed on...
gitpython: GitPython: Remote Code Execution via malicious Git template
A flaw was found in GitPython. An incomplete denylist in the unsafegitcloneoptions function fails to restrict the --template option. This allows a remote attacker to supply a malicious Git template directory, leading to arbitrary command execution during clone operations...
GHSA-X67C-8PWR-M8G3 SiYuan: Second-order SSTI to arbitrary SQL via attribute-view template column (queryBlocks): malicious imported package executes SQL on victim kernel
CVE: This vulnerability corresponds to CVE-2026-72807. Summary Attribute-view AV template columns are live-evaluated on every render and expose the queryBlocks template function, which runs raw SQL on the read-write database handle SelectBlocksRawStmt, using ?→argument string substitution rather...
EUVD-2026-57408
SiYuan: Second-order SSTI to arbitrary SQL via attribute-view template column queryBlocks: malicious imported package executes SQL on victim kernel...
EUVD-2026-62599
Orval: RCE via OpenAPI path - unescaped request-URL template literal backtick breakout...
NPM: Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)
NPM: Orval: RCE via OpenAPI path - unescaped request-URL template literal backtick breakout vulnerability discovered by ? in WordPress Npm orval versions 8.21.0...
Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)
Summary Orval emits the OpenAPI path into the generated request URL as a TEMPLATE LITERAL /users/... without escaping the backtick character. A path containing a backtick closes the template literal and injects a concatenation expression that is evaluated when the generated URL/request/key functi...
GHSA-FG9P-MRXR-HVQ7 Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)
Summary Orval emits the OpenAPI path into the generated request URL as a TEMPLATE LITERAL /users/... without escaping the backtick character. A path containing a backtick closes the template literal and injects a concatenation expression that is evaluated when the generated URL/request/key functi...
CVE-2026-78593
An insufficiently validated configuration field in Kibana's Cribl integration allows an authenticated user holding Kibana Fleet management privileges to inject attacker-controlled expressions into a server-side script template, resulting in an Elasticsearch ingest pipeline being written beyond th...
Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)
Summary When Orval is configured with output.baseUrl.getBaseUrlFromSpecification: true, it bakes the spec's servers0.url into the generated request URL as a template literal without escaping the backtick. A server URL containing a backtick closes the template literal and injects a concatenation...
EUVD-2026-62658
Orval: RCE via servers.url - unescaped request-URL template literal with getBaseUrlFromSpecification...
GHSA-88F2-FPV8-89Q2 Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)
Summary When Orval is configured with output.baseUrl.getBaseUrlFromSpecification: true, it bakes the spec's servers0.url into the generated request URL as a template literal without escaping the backtick. A server URL containing a backtick closes the template literal and injects a concatenation...
NPM: Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)
NPM: Orval: RCE via servers.url - unescaped request-URL template literal with getBaseUrlFromSpecification vulnerability discovered by ? in WordPress Npm orval versions 8.21.0...