Server-side Template Injection

binarytorch/larecipe is vulnerable to Server-side Template Injection SSTI. The vulnerability is due to improper handling of user input in template rendering, which allows an attacker to inject malicious templates and potentially achieve Remote Code Execution RCE in vulnerable server configuration...

Template Injection Vulnerability in Sawtooth Software's Lighthouse Studio (CVE-2025-34300)

This module exploits a template injection vulnerability in the Sawtooth Software Lighthouse Studio's ciwweb.pl web application. The application fails to properly sanitize user input within survey templates, allowing unauthenticated attackers to inject and execute arbitrary Perl commands on the...

Sawtooth Lighthouse Studio 安全漏洞

Sawtooth Lighthouse Studio is a federated analytics platform from Sawtooth USA. A security vulnerability exists in Sawtooth Lighthouse Studio versions prior to 9.16.14 that stems from template injection and could lead to the execution of arbitrary commands...

CVE-2025-53833

LaRecipe is an application that allows users to create documentation with Markdown inside a Laravel app. Versions prior to 2.8.1 are vulnerable to Server-Side Template Injection SSTI, which could potentially lead to Remote Code Execution RCE in vulnerable configurations. Attackers could execute...

CVE-2025-53833 LaRecipe is vulnerable to Server-Side Template Injection attacks

LaRecipe is an application that allows users to create documentation with Markdown inside a Laravel app. Versions prior to 2.8.1 are vulnerable to Server-Side Template Injection SSTI, which could potentially lead to Remote Code Execution RCE in vulnerable configurations. Attackers could execute...

CVE-2025-53833 LaRecipe is vulnerable to Server-Side Template Injection attacks

LaRecipe is an application that allows users to create documentation with Markdown inside a Laravel app. Versions prior to 2.8.1 are vulnerable to Server-Side Template Injection SSTI, which could potentially lead to Remote Code Execution RCE in vulnerable configurations. Attackers could execute...

EUVD-2025-21400

LaRecipe is an application that allows users to create documentation with Markdown inside a Laravel app. Versions prior to 2.8.1 are vulnerable to Server-Side Template Injection SSTI, which could potentially lead to Remote Code Execution RCE in vulnerable configurations. Attackers could execute...

CVE-2025-53833 LaRecipe is vulnerable to Server-Side Template Injection attacks

LaRecipe is an application that allows users to create documentation with Markdown inside a Laravel app. Versions prior to 2.8.1 are vulnerable to Server-Side Template Injection SSTI, which could potentially lead to Remote Code Execution RCE in vulnerable configurations. Attackers could execute...

CVE-2025-53833

LaRecipe (a Laravel-based documentation app)

GHSA-JV7X-XHV2-P5V2 LaRecipe is vulnerable to Server-Side Template Injection attacks

Impact Attackers could: 1. Execute arbitrary commands on the server 2. Access sensitive environment variables 3. Escalate access depending on server configuration A critical vulnerability was discovered in LaRecipe that allows an attacker to perform Server-Side Template Injection SSTI, potentiall...

LaRecipe is vulnerable to Server-Side Template Injection attacks

Impact Attackers could: 1. Execute arbitrary commands on the server 2. Access sensitive environment variables 3. Escalate access depending on server configuration A critical vulnerability was discovered in LaRecipe that allows an attacker to perform Server-Side Template Injection SSTI, potentiall...

PT-2025-29522

Name of the Vulnerable Software and Affected Versions: LaRecipe versions prior to 2.8.1 Description: LaRecipe is an application that allows users to create documentation with Markdown inside a Laravel app. Versions prior to 2.8.1 are vulnerable to Server-Side Template Injection SSTI, which could...

LaRecipe 安全漏洞

LaRecipe is a software by Saleem Hadad سليم حداد individual developer that uses MarkDown to write and publish documentation for Laravel applications. A security vulnerability exists in LaRecipe versions prior to 2.8.1 that stems from server-side template injection and could lead to remote code...

XWiki Platform SolrSearch Macro Remote Code Execution

XWiki Platform versions from 5.3-milestone-2 before 15.10.11 and from 16.0.0-rc-1 before 16.4.1 suffer from a Server-Side Template Injection SSTI due to the lack of sanitization of the SolrSearch Macro requests. By leveraging this vulnerability, a remote and unauthenticated attacker can achieve...

📄 Tiki Wiki CMS Groupware 28.3 Server-Side Template Injection

Tiki Wiki CMS Groupware versions 28.3 and below suffer from two server-side template injection vulnerabilities via specially crafted wiki pages. ---------------------------------------------------------------------------------- Tiki Wiki CMS Groupware '" The second vulnerability can be leveraged ...

CVE-2025-49521 Event-driven-ansible: template injection via git branch and refspec in eda projects

A flaw was found in the EDA component of the Ansible Automation Platform, where user-supplied Git branch or refspec values are evaluated as Jinja2 templates. This vulnerability allows authenticated users to inject expressions that execute commands or access sensitive files on the EDA worker. In...

CVE-2025-49521 Event-driven-ansible: template injection via git branch and refspec in eda projects

A flaw was found in the EDA component of the Ansible Automation Platform, where user-supplied Git branch or refspec values are evaluated as Jinja2 templates. This vulnerability allows authenticated users to inject expressions that execute commands or access sensitive files on the EDA worker. In...

CVE-2025-49521

CVE-2025-49521 affects the EDA component of Red Hat Ansible Automation Platform. The issue is template injection via user-provided Git branch or refspec values, allowing authenticated users to inject expressions that execute commands or read sensitive files on the EDA worker; in OpenShift this ca...

Template Injection

PySpur is vulnerable to Template Injection. The vulnerability is due to improper neutralization of special elements due to unsafe handling of the usermessage argument in the SingleLLMCallNode function of the Jinja2 Template Handler component...

Kingdee Cloud-Starry-Sky Enterprise Edition 安全漏洞

Kingdee Cloud-Starry-Sky Enterprise Edition is a digital transformation solution for growing enterprises from Kingdee, China. A security vulnerability exists in Kingdee Cloud-Starry-Sky Enterprise Edition version 6.x, 7.x, 8.x, and 9.0, which stems from improper neutralization of template element...