PT-2025-7139 · Q Free · Q-Free Maxtime

Name of the Vulnerable Software and Affected Versions: Q-Free MaxTime versions less than or equal to 2.11.0 Description: The issue allows an authenticated remote attacker to upload malicious files via crafted HTTP requests due to an unrestricted upload of files with dangerous types in the templat...

CVE-2025-26520

Cacti through 1.2.29 allows SQL injection in the template function in hosttemplates.php via the graphtemplate parameter. NOTE: this issue exists because of an incomplete fix for CVE-2024-54146...

Astra Linux – Vulnerability in Jinja2

Jinja is an extensible templating engine. In versions on the 3.x branch prior to 3.1.5, a bug in the Jinja compiler allowed an attacker who controlled both the content and the filename of a template to execute arbitrary Python code, regardless of whether Jinja’s sandbox was used. To exploit this...

GHSA-R385-C5FC-X56C CouchAuth has a Server-Side Template Injection vulnerability in its email functionality

A host header injection vulnerability exists in the NPM package of perfood/couch-auth = 0.21.2. By sending a specially crafted host header in the email change confirmation request, it is possible to trigger a SSTI which can be leveraged to run limited commands or leak server-side information...

CouchAuth has a Server-Side Template Injection vulnerability in its email functionality

A host header injection vulnerability exists in the NPM package of perfood/couch-auth = 0.21.2. By sending a specially crafted host header in the email change confirmation request, it is possible to trigger a SSTI which can be leveraged to run limited commands or leak server-side information...

CVE-2024-54954

OneBlog v2.3.6 was discovered to contain a template injection vulnerability via the template management department...

CVE-2024-54954

OneBlog v2.3.6 was discovered to contain a template injection vulnerability via the template management department...

jinja2: Jinja has a sandbox breakout through malicious filenames

A flaw was found in the Jinja2 package. A bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regardless of Jinja's sandbox being used. An attacker needs to be able to control both the filename and the contents o...

PT-2025-6098 · Perfood · Couch-Auth

Name of the Vulnerable Software and Affected Versions: perfood/couch-auth versions = 0.21.2 Description: A host header injection vulnerability exists in the NPM package of perfood/couch-auth. By sending a specially crafted host header in the email change confirmation request, it is possible to...

Azure Linux 3.0 Security Update: ansible (CVE-2023-5764)

The version of ansible installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-5764 advisory. - A template injection flaw was found in Ansible where a user's controller internal templating operations May...

CVE-2024-54954

OneBlog v2.3.6 was discovered to contain a template injection vulnerability via the template management department...

CVE-2024-54954

OneBlog v2.3.6 was discovered to contain a template injection vulnerability via the template management department...

EulerOS 2.0 SP11 : python-jinja2 (EulerOS-SA-2025-1164)

According to the versions of the python-jinja2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how the Jinja sandboxed environment detects calls to str.format...

CouchAuth 注入漏洞

CouchAuth is a Perfood open source authentication API. An injection vulnerability exists in CouchAuth 0.21.2 and earlier versions, which stems from the presence of host header injection in NPM packages, allowing an attacker to trigger an SSTI via a specially crafted request to disclose informatio...

CVE-2024-54954

OneBlog v2.3.6 is affected by a template injection vulnerability in the template management area (CVE-2024-54954). Affected product/component: OneBlog, version 2.3.6. Root cause details are not fully disclosed in the provided documents, but the vulnerability is described as template injection. Im...

OneBlog 安全漏洞

OneBlog is a Java blog. OneBlog suffers from a template injection vulnerability, no details of the vulnerability are provided at this time...

CVE-2024-57450

ChestnutCMS =1.5.0 is vulnerable to File Upload via the Create template function...

CVE-2019-18952

creationtimestamp| type| source ---|---|--- 2025-02-06 20:43:10+00:00| published-proof-of-concept| Telegram/QpVhOhXW3Z2UkqT7NrsQgFBmfNuPEzulIQixUIjUEw 2025-09-29 10:35:36+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2019/CVE-2019-18952.yaml 2025-09-30...

jinja2: Jinja has a sandbox breakout through malicious filenames

A flaw was found in the Jinja2 package. A bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regardless of Jinja's sandbox being used. An attacker needs to be able to control both the filename and the contents o...

CVE-2022-21648

Latte is an open source template engine for PHP. Versions since 2.8.0 Latte has included a template sandbox and in affected versions it has been found that a sandbox escape exists allowing for injection into web pages generated from Latte. This may lead to XSS attacks. The issue is fixed in the...