CVE-2018-20465

Craft CMS 3.x up to version 3.0.34 is vulnerable to a Server-Side Template Injection (SSTI) that allows remote authenticated administrators to read sensitive configuration data. The flaw is demonstrated by injecting a template snippet that accesses craft.app.config.DB.user and craft.app.config.DB...

GHSA-9FCP-VCQ9-9H2H OS Command Injection in craftercms:crafter-studio

A Server-Side Template Injection issue was discovered in Crafter CMS 3.0.18. Attackers with developer privileges may execute OS commands by Creating/Editing a template file .ftl filetype that triggers a call to freemarker.template.utility.Execute in the FreeMarker library during rendering of a we...

OS Command Injection in craftercms:crafter-studio

A Server-Side Template Injection issue was discovered in Crafter CMS 3.0.18. Attackers with developer privileges may execute OS commands by Creating/Editing a template file .ftl filetype that triggers a call to freemarker.template.utility.Execute in the FreeMarker library during rendering of a we...

Sql injection

A Server-Side Template Injection issue was discovered in Crafter CMS 3.0.18. Attackers with developer privileges may execute OS commands by Creating/Editing a template file .ftl filetype that triggers a call to freemarker.template.utility.Execute in the FreeMarker library during rendering of a we...

CVE-2018-19907

A Server-Side Template Injection issue was discovered in Crafter CMS 3.0.18. Attackers with developer privileges may execute OS commands by Creating/Editing a template file .ftl filetype that triggers a call to freemarker.template.utility.Execute in the FreeMarker library during rendering of a we...

CVE-2018-19907

A Server-Side Template Injection issue was discovered in Crafter CMS 3.0.18. Attackers with developer privileges may execute OS commands by Creating/Editing a template file .ftl filetype that triggers a call to freemarker.template.utility.Execute in the FreeMarker library during rendering of a we...

CVE-2018-19907

Crafter CMS 3.0.18 is affected by a Server-Side Template Injection vulnerability. Attackers with developer privileges can cause the FreeMarker library call freemarker.template.utility.Execute while rendering a webpage by creating/editing a template file (.ftl), leading to OS command execution. Th...

Shopify: H1514 Server Side Template Injection in Return Magic email templates?

Summary: Possible template injection in return magic email templates. Description: I've been playing with return magic workflow email templates and there seems to be some kinda of template injection but I am not sure if it's exploitable or even valid. Here is why I think it could be vulnerable: I...

CVE-2018-11061

RSA NetWitness Platform versions prior to 11.1.0.2 and RSA Security Analytics versions prior to 10.6.6 are vulnerable to a server-side template injection vulnerability due to insecure configuration of the template engine used in the product. A remote authenticated malicious RSA NetWitness Server...

Sql injection

RSA NetWitness Platform versions prior to 11.1.0.2 and RSA Security Analytics versions prior to 10.6.6 are vulnerable to a server-side template injection vulnerability due to insecure configuration of the template engine used in the product. A remote authenticated malicious RSA NetWitness Server...

CVE-2018-11061

RSA NetWitness Platform versions prior to 11.1.0.2 and RSA Security Analytics versions prior to 10.6.6 are vulnerable to a server-side template injection caused by insecure template engine configuration. A remote authenticated malicious RSA NetWitness Server user with an Admin or Operator role co...

CVE-2018-11061

RSA NetWitness Platform versions prior to 11.1.0.2 and RSA Security Analytics versions prior to 10.6.6 are vulnerable to a server-side template injection vulnerability due to insecure configuration of the template engine used in the product. A remote authenticated malicious RSA NetWitness Server...

CVE-2018-14716

A Server Side Template Injection SSTI was discovered in the SEOmatic plugin before 3.1.4 for Craft CMS, because requests that don't match any elements incorrectly generate the canonicalUrl, and can lead to execution of Twig code...

CVE-2018-14716

A Server Side Template Injection SSTI was discovered in the SEOmatic plugin before 3.1.4 for Craft CMS, because requests that don't match any elements incorrectly generate the canonicalUrl, and can lead to execution of Twig code...

Code injection

A Server Side Template Injection SSTI was discovered in the SEOmatic plugin before 3.1.4 for Craft CMS, because requests that don't match any elements incorrectly generate the canonicalUrl, and can lead to execution of Twig code...

CVE-2018-14716

CVE-2018-14716 affects the SEOmatic plugin for Craft CMS (before 3.1.4). A Server Side Template Injection (SSTI) occurs because requests that don’t match any elements cause an incorrect canonicalUrl, enabling execution of Twig code. Documented exploits exist (exploit-db PoC) and public advisories...

CVE-2018-14716

A Server Side Template Injection SSTI was discovered in the SEOmatic plugin before 3.1.4 for Craft CMS, because requests that don't match any elements incorrectly generate the canonicalUrl, and can lead to execution of Twig code...

Craft CMS SEOmatic plugin 3.1.4 - Server-Side Template Injection

Exploit Title: Craft CMS SEOmatic plugin 3.1.4 - Server-Side Template Injection Date: 2018-07-20 Software Link: https://github.com/nystudio107/craft-seomatic Exploit Author: Sebastian Kriesten 0xB455 Contact: https://twitter.com/0xB455 CVE: CVE-2018-14716 Category: webapps 1. Description An...

Craft CMS SEOmatic plugin 3.1.4 - Server-Side Template Injection

Craft CMS SEOmatic plugin 3.1.4 - Server-Side Template Injection Exploit Title: Craft CMS SEOmatic plugin 3.1.4 - Server-Side Template Injection Date: 2018-07-20 Software Link: https://github.com/nystudio107/craft-seomatic Exploit Author: Sebastian Kriesten 0xB455 Contact:...

Server-Side Template Injection (SSTI)

twig/twig is vulnerable to server-side template injection SSTI attacks. The vulnerabiltiy exists due to the way twig/twig interprets the value of the token in the templates, allowing commands to be executed depending on the vulnerable application...