The vulnerability of the Jinja HTML templating compiler lies in its failure to properly eliminate special elements during template creation. This allows attackers to trigger a service failure.

The vulnerability of the Jinja HTML template compiler relates to the lack of measures taken to neutralize special elements in the template creation mechanism. Exploiting this vulnerability can allow an attacker to cause service failures...

Improper Neutralization of Special Elements Used in a Template Engine

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements Used in a Template Engine via the formatblockparametertemplatefromworkflowruncontext function in the block.py file. An attacker can access sensitive information by exploiting the Jinja runtime...

VulnCheck KEV: CVE-2024-46507

Yeti is vulnerable to an authentication bypass using a hardcoded JWT secret with a known username that exploits a server side template injection vulnerability...

Skyvern SSTI Remote Code Execution

This module exploits SSTI vulnerability in Skyvern use exploit/linux/http/skyvern/ssticve202549619 msf undefinedssticve202549619 show actions ...actions... msf undefinedssticve202549619 set ACTION msf undefinedssticve202549619 show options ...show and set options... msf undefinedssticve202549619...

VulnCheck KEV: CVE-2025-47916

Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php. The issue lies within the themeeditor controller file: /applications/core/modules/front/system/themeeditor.php, where a protected method named customCss can be invoked by...

CLSA-2025-1748945064 Fix CVE(s): CVE-2019-10206, CVE-2019-14856

SECURITY UPDATE: password prompt vulnerability from template expansion - debian/patches/CVE-2019-10206.patch: prevent templating of passwords from prompt to avoid special characters triggering it incorrectly - CVE-2019-10206 - debian/patches/CVE-2019-14856.patch: fix incomplete CVE-2019-10206 pat...

Poster: Libdebug, Build Your Own Debugger for a Better (Hello) World

Automated debugging, long pursued in a variety of fields from software engineering to cybersecurity, requires a framework that offers the building blocks for a programmable debugging workflow. However, existing debuggers are primarily tailored for human interaction, and those designed for...

Exploit for CVE-2025-52159

This vulnerability chains has been assigned the following CVE ID...

Exploit for CVE-2025-52159

This vulnerability chains has been assigned the following CVE ID...

PT-2025-24341

Name of the Vulnerable Software and Affected Versions Skyvern versions 0.1.0 through 0.1.85 Description The issue is related to a Jinja runtime leak in the sdk/workflow/models/block.py file. This leak can potentially be exploited, although specific details about real-world incidents or the...

Security Bulletin: There are multiple vulnerabilities that can affect IBM Fusion HCI and IBM Fusion HCI for watsonx

Summary Multiple vulnerabilities affecting IBM Fusion HCI and IBM Fusion HCI for watsonx could have resulted in reduced security. These issues have since been resolved. CVE-2023-5115, CVE-2023-5764, CVE-2024-9902, CVE-2024-8775, CVE-2024-11079, CVE-2024-9506, CVE-2024-43799, CVE-2024-6119,...

JeeWMS 路径遍历漏洞

JeeWMS is a JAVA-based warehouse management system from China Huayi JeeWMS. JeeWMS 20250504 and previous versions of path traversal vulnerability, the vulnerability stems from the file /cgformTemplateController.do?doAdd function doAdd there is a path traversal...

CVE-2025-5325

A vulnerability has been found in zhilink 智互联深圳科技有限公司 ADP Application Developer Platform 应用开发者平台 1.0.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /adpweb/a/ica/api/service/rfa/testService. The manipulation leads to improper neutralization of...

CVE-2025-5325

CVE-2025-5325 affects Zhilink ADP Application Developer Platform (version 1.0.0). The vulnerability is in an unknown functionality of the file /adpweb/a/ica/api/service/rfa/testService, caused by improper neutralization of special elements used in a template engine. It is exploitable remotely and...

CVE-2025-5325 zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 testService special elements used in a template engine

A vulnerability has been found in zhilink 智互联深圳科技有限公司 ADP Application Developer Platform 应用开发者平台 1.0.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /adpweb/a/ica/api/service/rfa/testService. The manipulation leads to improper neutralization of...

CVE-2025-5325 zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 testService special elements used in a template engine

A vulnerability has been found in zhilink 智互联深圳科技有限公司 ADP Application Developer Platform 应用开发者平台 1.0.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /adpweb/a/ica/api/service/rfa/testService. The manipulation leads to improper neutralization of...

Security Bulletin: IBM Maximo Application Suite - Monitor Component is vulnerable to jinja2-3.1.4-py3-none-any.whl, jinja2-3.1.5-py3-none-any.whl CVE-2025-27516

Summary IBM Maximo Application Suite - Monitor Component is vulnerable to jinja2-3.1.4-py3-none-any.whl, jinja2-3.1.5-py3-none-any.whl CVE-2025-27516. This bulletin identifies the steps to take to address the vulnerabilities. Vulnerability Details CVEID:CVE-2025-27516 DESCRIPTION: Jinja is an...

[SECURITY] [DLA 4186-1] php-twig security update

Debian LTS Advisory DLA-4186-1 [email protected] https://www.debian.org/lts/security/ Markus Koschany May 28, 2025 https://wiki.debian.org/LTS Package : php-twig Version : 2.14.3-1+deb11u4 CVE ID : CVE-2024-51754 Twig is a template language for PHP. In a sandbox, an attacker can call...

Zhilink ADP Application Developer Platform 安全漏洞

Zhilink ADP Application Developer Platform is an application development platform from Zhilink, which provides one-stop development tools and environment to support rapid building and deployment of enterprise-level applications. A security vulnerability exists in Zhilink ADP Application Developer...

CLSA-2025-1748451788 Fix CVE(s): CVE-2021-3583

SECURITY UPDATE: template Injection Vulnerability - debian/patches/CVE-2021-3583.patch: fix unsafe preservation across newlines to ensure always having unsafe - CVE-2021-3583...