Server-Side Template Injection (SSTI)

opencart/opencart is vulnerable to Server-Side Template Injection SSTI.The vulnerability is due to the edit theme function allowing attackers with admin access to execute arbitrary code via template payloads...

Exploit for CVE-2024-42587

LLMVulnSphere All Security Issues about LLM Software Componen...

Template Injection

Apache StreamPark is vulnerable to template injection. The vulnerability is due to insufficient input validation that allows attacker to perform a template injection that potentially leads to execution of arbitrary code on server...

Vulnerabilities fixed in Cisco Secure Email Gateway

Two vulnerabilities have been fixed in Cisco Secure Email Gateway. The most serious vulnerability concerns CVE-2024-20401 and allows an unauthenticated malicious person, through sending a mail with specially prepared attachment: Add users with root privileges Modify the configuration of the devic...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via the template processing mechanism. An attacker can execute arbitrary code on the server by injecting malicious templates after successfully logging into the system. Remediation Upgrade...

Apache StreamPark: FreeMarker SSTI RCE Vulnerability

On versions before 2.1.4, a user could log in and perform a template injection attack resulting in Remote Code Execution on the server, The attacker must successfully log into the system to launch an attack, so this is a moderate-impact vulnerability. Mitigation: all users should upgrade to 2.1.4...

CVE-2024-29178

On versions before 2.1.4, a user could log in and perform a template injection attack resulting in Remote Code Execution on the server, The attacker must successfully log into the system to launch an attack, so this is a moderate-impact vulnerability. Mitigation: all users should upgrade to 2.1.4...

CVE-2024-29178

Apache StreamPark before version 2.1.4 is affected by a FreeMarker SSTI vulnerability that an authenticated user can exploit to achieve Remote Code Execution on the server. Root cause: template injection via FreeMarker in the application, with high impact (CVE-2024-29178). Remediation: upgrade to...

CVE-2024-29178 Apache StreamPark: FreeMarker SSTI RCE Vulnerability

On versions before 2.1.4, a user could log in and perform a template injection attack resulting in Remote Code Execution on the server, The attacker must successfully log into the system to launch an attack, so this is a moderate-impact vulnerability. Mitigation: all users should upgrade to 2.1.4...

Template Injection

github.com/requarks/wiki is vulnerable to Template injection. The vulnerability is due to improper sanitization of user inputs, allowing attackers to inject malicious JavaScript into the content section of pages. Attackers can exploit this by inserting an invalid HTML tag with a template injectio...

Apache StreamPark 代码注入漏洞

Apache StreamPark is the United States Apache Apache Foundation of a streaming media application development framework. A code injection vulnerability exists in Apache StreamPark versions prior to 2.1.4, which stems from a user being able to log in and perform a template injection attack. No...

ServiceNow Server-Side Template Injection

ServiceNow is affected by a vulnerability allowing an unauthenticated attacker to obtain Server-Side Template Injection via a specially forged request. This vulnerability can be used to execute arbitrary code. No source data...

PT-2024-22784

Name of the Vulnerable Software and Affected Versions SoftwareX versions prior to 2.1.4 Description The issue allows a user to perform a template injection attack, resulting in Remote Code Execution on the server. This can be done after a successful login, making it a moderate-impact issue...

GHSA-XRH7-2GFQ-4RCQ openCart Server-Side Template Injection (SSTI) vulnerability

A Server-Side Template Injection SSTI vulnerability in the Theme Editor Function of openCart project v4.0.2.3 allows attackers to execute arbitrary code via injecting a crafted payload...

openCart Server-Side Template Injection (SSTI) vulnerability

A Server-Side Template Injection SSTI vulnerability in the Theme Editor Function of openCart project v4.0.2.3 allows attackers to execute arbitrary code via injecting a crafted payload...

GHSA-C3Q9-C27P-CW9H projectdiscovery/nuclei allows unsigned code template execution through workflows

Summary Find a way to execute code template without -code option and signature. Details write a code.yaml: yaml id: code info: name: example code template author: ovi3 code: - engine: - sh - bash source: | id http: - raw: - | POST /re HTTP/1.1 Host: Hostname coderesponse workflows: - matchers: -...

CVE-2024-40641 Unsigned code template execution through workflows in projectdiscovery/nuclei

Nuclei is a fast and customizable vulnerability scanner based on simple YAML based DSL. In affected versions it a way to execute code template without -code option and signature has been discovered. Some web applications inherit from Nuclei and allow users to edit and execute workflow files. In...

CVE-2024-6220

creationtimestamp| type| source ---|---|--- 2024-07-17 10:41:45+00:00| seen| https://t.me/cvedetector/1064 2024-08-01 10:18:47+00:00| exploited| https://t.me/HackingInsights/8275 2025-12-03 08:31:16+00:00| confirmed|...

PT-2024-27131

Name of the Vulnerable Software and Affected Versions OpenCart version 4.0.2.3 Description The issue is related to a Server-Side Template Injection SSTI vulnerability via the Theme Editor Function. This allows attackers to execute arbitrary code by injecting a crafted payload. Recommendations For...

Xenforo 2.2.15 Remote Code Execution

----------------------------------------------------------------------- XenForo = 2.2.15 Template System Remote Code Execution Vulnerability ----------------------------------------------------------------------- - Software Link: https://xenforo.com - Affected Versions: Version 2.2.15 and prior...