2777 matches found
CVE-2025-60355
zhangyd-c OneBlog v2.3.9 and before was vulnerable to SSTI Server-Side Template Injection via FreeMarker templates...
OneBlog 安全漏洞
OneBlog is a beautiful and powerful Java blog by yadong.zhang individual developer. A security vulnerability exists in OneBlog versions prior to 2.3.9, which stems from a server-side template injection in FreeMarker templates...
CVE-2025-60355
zhangyd-c OneBlog v2.3.9 and before was vulnerable to SSTI Server-Side Template Injection via FreeMarker templates...
CVE-2025-60355
zhangyd-c OneBlog v2.3.9 and before was vulnerable to SSTI Server-Side Template Injection via FreeMarker templates...
CVE-2025-60355
zhangyd-c OneBlog v2.3.9 and before was vulnerable to SSTI Server-Side Template Injection via FreeMarker templates...
CVE-2025-60355
CVE-2025-60355 affects the web application OneBlog prior to version 2.3.9. The vulnerability is a Server-Side Template Injection (SSTI) via FreeMarker templates, caused by unsafe processing of templates on the server. The CVE entries indicate a high-impact profile (CVSS 3.1: 9.8, CRITICAL) with n...
PT-2025-44194
Name of the Vulnerable Software and Affected Versions zhangyd-c OneBlog versions prior to 2.3.9 Description The software is susceptible to Server-Side Template Injection SSTI through FreeMarker templates. SSTI allows an attacker to inject malicious code into the server, potentially leading to...
EUVD-2025-35098
Uptime Kuma Server-side Template Injection SSTI in Notification Templates Allows Arbitrary File Read...
Uptime Kuma Server-side Template Injection (SSTI) in Notification Templates Allows Arbitrary File Read
Summary In some Notification types e.g., Webhook, Telegram, the send function allows user-controlled renderTemplate input. This leads to a Server-side Template Injection SSTI vulnerability that can be exploited to read arbitrary files from the server. Details The root cause is how Uptime Kuma...
Metasploit Wrap-Up 10/17/2025
New module content 1 Remote Code Execution Vulnerability in MotionEye Frontend CVE-2025-60787 Authors: Maksim Rogov and prabhatverma47 Type: Exploit Pull request: 20585 contributed by vognik Path: linux/http/motioneyeauthrcecve202560787 AttackerKB reference: CVE-2025-60787 Description: Adds a...
GHSA-527Q-4WQV-G9WJ bagisto has Server Side Template Injection (SSTI) in Product Description
Summary Bagisto v2.3.7 is vulnerable to Server-Side Template Injection SSTI due to unsanitized user input being processed by the server-side templating engine when rendering product descriptions. This allows an attacker with product creation privileges to inject arbitrary template expressions tha...
bagisto has Server Side Template Injection (SSTI) in Product Description
Summary Bagisto v2.3.7 is vulnerable to Server-Side Template Injection SSTI due to unsanitized user input being processed by the server-side templating engine when rendering product descriptions. This allows an attacker with product creation privileges to inject arbitrary template expressions tha...
CVE-2025-62416 bagisto - Server Side Template Injection (SSTI) in Product Description
Bagisto is an open source laravel eCommerce platform. Bagisto v2.3.7 is vulnerable to Server-Side Template Injection SSTI due to unsanitized user input being processed by the server-side templating engine when rendering product descriptions. This allows an attacker with product creation privilege...
CVE-2025-62416
Bagisto v2.3.7 is affected by Server-Side Template Injection (SSTI) in product descriptions due to unsanitized user input being rendered by Laravel Blade. With product-creation privileges, an attacker can inject template expressions that the backend evaluates, potentially enabling Remote Code Exe...
CVE-2025-62416 bagisto - Server Side Template Injection (SSTI) in Product Description
Bagisto is an open source laravel eCommerce platform. Bagisto v2.3.7 is vulnerable to Server-Side Template Injection SSTI due to unsanitized user input being processed by the server-side templating engine when rendering product descriptions. This allows an attacker with product creation privilege...
Elastic Cloud Enterprise (ECE) 3.8.2 and 4.0.2 Security Update (ESA-2025-21)
Elastic Cloud Enterprise ECE Improper Neutralization of Special Elements Used in a Template Engine ESA-2025-21 Improper neutralization of special elements used in a template engine in Elastic Cloud Enterprise ECE can lead to a malicious actor with Admin access exfiltrating sensitive information a...
📄 MotionEye Frontend 0.43.1b4 Remote Code Execution
This Metasploit module exploits a template injection vulnerability in the MotionEye Frontend. MotionEye Frontend versions 0.43.1b4 and prior are vulnerable to OS command injection in configuration parameters such as imagefilename. Unsanitized user input is written to MotionEye Frontend...
EUVD-2021-12891
Malware in sbrugna...