CVE-2025-25362

A Server-Side Template Injection SSTI vulnerability in Spacy-LLM v0.7.2 allows attackers to execute arbitrary code via injecting a crafted payload into the template field...

Template Injection

Overview Jinja2 is a template engine written in pure Python. It provides a Django inspired non-XML syntax but supports inline expressions and an optional sandboxed environment. Affected versions of this package are vulnerable to Template Injection through the |attr filter. An attacker that contro...

PT-2025-9854

Name of the Vulnerable Software and Affected Versions Spacy-LLM version 0.7.2 Description A Server-Side Template Injection SSTI vulnerability allows attackers to execute arbitrary code via injecting a crafted payload into the template field. Recommendations For Spacy-LLM version 0.7.2, as a...

CVE-2025-25362

A Server-Side Template Injection SSTI vulnerability in Spacy-LLM v0.7.2 allows attackers to execute arbitrary code via injecting a crafted payload into the template field...

spacy-llm 代码注入漏洞

spacy-llm is an Explosion open source application that integrates LLM into a structured NLP pipeline. A security vulnerability exists in spacy-llm version 0.7.2 that stems from server-side template injection, which leads to the execution of arbitrary code...

CVE-2025-25362

CVE-2025-25362 describes a Server-Side Template Injection (SSTI) in Spacy-LLM v0.7.2 that lets attackers execute arbitrary code by crafting payloads in the template field. Affected software is the spacy-llm package; root cause is SSTI exposure through the template configuration. Impact is high (r...

OneBlog Template Injection Vulnerability

OneBlog is a Java blog. OneBlog suffers from a template injection vulnerability, no details of the vulnerability are provided at this time...

CVE-2025-25768

MRCMS v3.1.2 was discovered to contain a server-side template injection SSTI vulnerability in the component \servlet\DispatcherServlet.java. This vulnerability allows attackers to execute arbitrary code via a crafted payload...

CVE-2025-25768

MRCMS v3.1.2 was discovered to contain a server-side template injection SSTI vulnerability in the component \servlet\DispatcherServlet.java. This vulnerability allows attackers to execute arbitrary code via a crafted payload...

PT-2025-7574 · Mrcms · Mrcms

Name of the Vulnerable Software and Affected Versions: MRCMS version 3.1.2 Description: The issue is related to a server-side template injection SSTI vulnerability. This vulnerability allows attackers to execute arbitrary code via a crafted payload. It is located in the component...

CVE-2025-25768

CVE-2025-25768 affects MRCMS v3.1.2 with a server-side template injection vulnerability in DispatcherServlet.java, enabling arbitrary code execution via a crafted payload. The connected documents describe the root cause and impact but do not provide a patch version or mitigation details; exploita...

CVE-2025-25768

MRCMS v3.1.2 was discovered to contain a server-side template injection SSTI vulnerability in the component \servlet\DispatcherServlet.java. This vulnerability allows attackers to execute arbitrary code via a crafted payload...

CVE-2025-25768

MRCMS v3.1.2 was discovered to contain a server-side template injection SSTI vulnerability in the component \servlet\DispatcherServlet.java. This vulnerability allows attackers to execute arbitrary code via a crafted payload...

CVE-2025-25768

MRCMS v3.1.2 was discovered to contain a server-side template injection SSTI vulnerability in the component \servlet\DispatcherServlet.java. This vulnerability allows attackers to execute arbitrary code via a crafted payload...

MRCMS 安全漏洞

MRCMS is a content management system by marker personal developer. A security vulnerability exists in MRCMS version v3.1.2, which stems from the servletDispatcherServlet.java module containing a server-side template injection vulnerability...

CVE-2024-29178

On versions before 2.1.4, a user could log in and perform a template injection attack resulting in Remote Code Execution on the server, The attacker must successfully log into the system to launch an attack, so this is a moderate-impact vulnerability. Mitigation: all users should upgrade to 2.1.4...

USN-6846-3 ansible regression

USN-6846-1 fixed vulnerabilities in ansible. The update introduced a regression in ansible. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that Ansible incorrectly handled certain inputs when using towercallback parameter. If a user...

USN-6846-3: Ansible regression

USN-6846-1 fixed vulnerabilities in ansible. The update introduced a regression in ansible. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that Ansible incorrectly handled certain inputs when using towercallback parameter. If a user...

CVE-2024-54954

OneBlog v2.3.6 was discovered to contain a template injection vulnerability via the template management department...

CVE-2024-57177

A host header injection vulnerability exists in the NPM package of perfood/couch-auth = 0.21.2. By sending a specially crafted host header in the email change confirmation request, it is possible to trigger a SSTI which can be leveraged to run limited commands or leak server-side information...