2957 matches found
CVE-2025-10380 Advanced Views – Display Posts, Custom Fields, and More <= 3.7.19 - Authenticated (Author+) Remote Code Execution via SSTI
The Advanced Views – Display Posts, Custom Fields, and More plugin for WordPress is vulnerable to Server-Side Template Injection in all versions up to, and including, 3.7.19. This is due to insufficient input sanitization and lack of access control when processing custom Twig templates in the Mod...
CVE-2025-10380 Advanced Views – Display Posts, Custom Fields, and More <= 3.7.19 - Authenticated (Author+) Remote Code Execution via SSTI
The Advanced Views – Display Posts, Custom Fields, and More plugin for WordPress is vulnerable to Server-Side Template Injection in all versions up to, and including, 3.7.19. This is due to insufficient input sanitization and lack of access control when processing custom Twig templates in the Mod...
CVE-2025-10380
The CVE-2025-10380 entry describes a Server-Side Template Injection (SSTI) in the WordPress plugin Advanced Views – Display Posts, Custom Fields, and More (ACF-Views) affecting all versions up to and including 3.7.19. Root cause: insufficient input sanitization and lack of access control when pro...
Server-Side Template Injection
solspace/craft-freeform is vulnerable to Server-Side Template Injection SSTI. The vulnerability is due to improper input handling because the submission title field in forms allows arbitrary code injection when edited by users with form editing access...
PPress 安全漏洞
PPress is a Python based blog CMS system by yandaozi individual developer. A security vulnerability exists in PPress version 0.0.9, which originates from server-side template injection and could lead to the execution of arbitrary code...
CVE-2025-54815
Server-side template injection SSTI vulnerability in PPress 0.0.9 allows attackers to execute arbitrary code via crafted themes...
CVE-2025-54815
Server-side template injection SSTI vulnerability in PPress 0.0.9 allows attackers to execute arbitrary code via crafted themes...
CVE-2025-54815
Server-side template injection SSTI vulnerability in PPress 0.0.9 allows attackers to execute arbitrary code via crafted themes...
CVE-2025-54815
Server-side template injection SSTI vulnerability in PPress 0.0.9 allows attackers to execute arbitrary code via crafted themes...
Exploit for Path Traversal in Atlassian Confluence_Server
CVE-2019-3396 CVE-2019-3396 confluence SSTI RCE 🔎 What is...
XWiki Platform 15.10.10 - Metasploit Module for Remote Code Execution (RCE)
Exploit Title: XWiki Platform 15.10.10 - Metasploit Module for Remote Code Execution RCE Date: 09/01/2025 Exploit Author: Maksim Rogov Vendor Homepage: https://www.xwiki.org/ Software Link: https://www.xwiki.org/xwiki/bin/view/Download/ Version: 5.3‑milestone‑2 ≤ v 'Remote Code Execution...
Metasploit Wrap-Up 09/12/25
New LightHouse Studio RCE module This week we've added a new module that exploits an unauthenticated template injection vulnerability CVE-2025-34300 in Sawtooth Software’s Lighthouse Studio, allowing arbitrary Perl execution via survey templates in versions prior to 9.16.14. This module has the...
CVE-2025-9556
Langchaingo supports the use of jinja2 syntax when parsing prompts, which is in turn parsed using the gonja library v1.5.3. Gonja supports include and extends syntax to read files, which leads to a server side template injection vulnerability within langchaingo, allowing an attacker to insert a...
CVE-2025-9556
CVE-2025-9556 affects Langchaingo through the gonja-based prompt parsing that supports jinja2 syntax. The include/extends features in gonja 1.5.3 allow reading files, enabling server-side template injection (e.g., reading /etc/passwd). Affected details and remediation are supported by multiple so...
CVE-2025-9556 CVE-2025-9556
Langchaingo supports the use of jinja2 syntax when parsing prompts, which is in turn parsed using the gonja library v1.5.3. Gonja supports include and extends syntax to read files, which leads to a server side template injection vulnerability within langchaingo, allowing an attacker to insert a...
Langchaingo supports jinja2 and gonja for syntax parsing, allowing for arbitrary file read
Overview LangChainGo, the Go implementation of LangChain, a large language model LLM application building framework, has been discovered to contain an arbitrary file read vulnerability. The vulnerability, tracked as CVE-2025-9556, allows for arbitrary file read through the Gonja template engine...
PT-2025-37319
Name of the Vulnerable Software and Affected Versions: langchaingo affected versions not specified Description: langchaingo utilizes the gonja library version 1.5.3 to parse prompts that support jinja2 syntax. The gonja library’s support for include and extend syntax, which allows reading files,...
Remote Code Execution Vulnerability in MotionEye Frontend (CVE-2025-60787)
This module exploits a template injection vulnerability in the MotionEye Frontend. MotionEye Frontend versions 0.43.1b4 and prior are vulnerable to OS Command Injection in configuration parameters such as imagefilename. Unsanitized user input is written to MotionEye Frontend configuration files,...
📄 Sawtooth Software Lighthouse Studios Template Injection
This Metasploit module exploits a template injection vulnerability in the Sawtooth Software Lighthouse Studios ciwweb.pl web application. The application fails to properly sanitize user input within survey templates, allowing unauthenticated attackers to inject and execute arbitrary Perl commands...