CVE-2025-3804 thautwarm vscode-diana Jinja2 Template Gen.py injection

A vulnerability classified as critical has been found in thautwarm vscode-diana 0.0.1. Affected is an unknown function of the file Gen.py of the component Jinja2 Template Handler. The manipulation leads to injection. Attacking locally is a requirement. The exploit has been disclosed to the public...

CVE-2025-3804 thautwarm vscode-diana Jinja2 Template Gen.py injection

A vulnerability classified as critical has been found in thautwarm vscode-diana 0.0.1. Affected is an unknown function of the file Gen.py of the component Jinja2 Template Handler. The manipulation leads to injection. Attacking locally is a requirement. The exploit has been disclosed to the public...

VSCode-Diana 安全漏洞

VSCode-Diana is a VSCode plugin that provides basic language support for DianaScript by the individual developer Taine Zhao. A security vulnerability exists in VSCode-Diana version 0.0.1, which stems from an injection issue in the Jinja2 template handling component in the file Gen.py...

PT-2025-17382 · Unknown · Sarrionandia Tournatrack +1

Name of the Vulnerable Software and Affected Versions: sarrionandia tournatrack up to 4c13a23f43da5317eea4614870a7a8510fc540ec Description: A critical vulnerability was found in the Jinja2 Template Handler component, specifically in the file check id.py. The manipulation of the ID argument leads ...

CVE-2023-32197

A Improper Privilege Management vulnerability in SUSE rancher in RoleTemplateobjects when external=true is set can lead to privilege escalation in specific scenarios.This issue affects rancher: from 2.7.0 before 2.7.14, from 2.8.0 before 2.8.5...

CVE-2024-40073

SourceCodester Online ID Generator System 1.0 is affected by a SQL injection vulnerability in the template parameter of id_generator/admin/?page=generate&template=4. The root cause is improper input handling leading to injection, exposing high-risk impact on confidentiality, integrity, and availa...

SourceCodester Online ID Generator System 安全漏洞

SourceCodester Online ID Generator System is an online identity generator system from SourceCodester open source. A security vulnerability exists in SourceCodester Online ID Generator System version 1.0, which originates from a SQL injection due to incorrect manipulation of the parameter template...

Privilege Chaining

Overview Affected versions of this package are vulnerable to Privilege Chaining through the spec.template.container configuration in the EventSource and Sensor custom resources. An attacker can gain privileged access to the host system and cluster by injecting commands into a container template...

Wallarm Research Releases Nuclei Template to Counter Threats Targeting LLM Apps

Wallarm Research has just released a powerful new Nuclei template targeting a new kind of exposure: the Model Context Protocol MCP. This isn’t about legacy devtools or generic JSON-RPC pinging. It’s about the protocol fueling next-gen LLM applications — and it’s already showing up exposed in the...

OESA-2025-1392 ansible security update

Ansible is a radically simple model-driven configuration management, multi-node deployment, and remote task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred t...

OESA-2025-1391 ansible security update

Ansible is a radically simple model-driven configuration management, multi-node deployment, and remote task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred t...

OESA-2025-1393 ansible security update

Ansible is a radically simple model-driven configuration management, multi-node deployment, and remote task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred t...

PT-2025-15668 · Tiki · Tiki

Name of the Vulnerable Software and Affected Versions: Tiki versions prior to 28.3 Tiki versions prior to 21.12 Tiki versions prior to 24.8 Tiki versions prior to 27.2 Description: The issue concerns the wikiplugin includetpl in lib/wiki-plugins/wikiplugin includetpl.php in Tiki, which mishandles...

PT-2025-29823

Name of the Vulnerable Software and Affected Versions: Lighthouse Studio versions prior to 9.16.14 Description: A template injection vulnerability exists in Lighthouse Studio’s Perl web application ciwweb.pl. Exploitation allows an unauthenticated attacker to execute arbitrary commands on the web...

CVE-2025-3214 JFinal CMS readTemplate engine.getTemplate path traversal

A vulnerability has been found in JFinal CMS up to 5.2.4 and classified as problematic. Affected by this vulnerability is the function engine.getTemplate of the file /readTemplate. The manipulation of the argument template leads to path traversal. The attack can be launched remotely. The exploit...

Security Bulletin: IBM Maximo Application Suite - Predict Component vulnerable to jinja is an extensible templating engine.

Summary Security Bulletin: IBM Maximo Application Suite - Predict Component vulnerable to jinja is an extensible templating engine. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2025-27516 DESCRIPTION: Jinja is an extensible...

BIT-JOOMLA-2021-23131 [20210305] - Core - Input validation within the template manager

An issue was discovered in Joomla! 3.2.0 through 3.9.24. Missing input validation within the template manager...

jinja2: Jinja has a sandbox breakout through malicious filenames

A flaw was found in the Jinja2 package. A bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regardless of Jinja's sandbox being used. An attacker needs to be able to control both the filename and the contents o...

EulerOS 2.0 SP13 : python-jinja2 (EulerOS-SA-2025-1341)

According to the versions of the python-jinja2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Jinja is an extensible templating engine. In versions on the 3.x branch prior to 3.1.5, a bug in the Jinja compiler allows an attacker that...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the renderFormField function in templatefunc.go. If an application is using RenderForm, an attacker can execute scripts by supplying malicious input in fields like DisplayName. Details Cross-site scripting or...