org.thymeleaf:thymeleaf-spring3 (2.0.4) potentially affected by CVE-2026-40477 via org.thymeleaf:thymeleaf (2.0.4)

org.thymeleaf:thymeleaf MAVEN version 2.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.thymeleaf:thymeleaf and may be impacted: - org.thymeleaf:thymeleaf-spring3 2.0.4 Source cves: CVE-2026-40477 Source advisory: OSV:GHSA-R4V4-5MWR-2FWR...

Template Injection

Overview Affected versions of this package are vulnerable to Template Injection due to the TemplateEngine's improper restriction of accessible object scope during expression evaluation. An attacker can inject into sensitive objects to execute unauthorized actions. Remediation Upgrade...

Template Injection

Overview Affected versions of this package are vulnerable to Template Injection due to the TemplateEngine's improper restriction of accessible object scope during expression evaluation. An attacker can inject into sensitive objects to execute unauthorized actions. Remediation Upgrade...

Template Injection

Overview Affected versions of this package are vulnerable to Template Injection due to the TemplateEngine's improper restriction of accessible object scope during expression evaluation. An attacker can inject into sensitive objects to execute unauthorized actions. Remediation Upgrade...

GHSA-R4V4-5MWR-2FWR Improper restriction of the scope of accessible objects in Thymeleaf expressions

Impact A security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf up to and including 3.1.3.RELEASE. Although the library provides mechanisms to prevent expression injection, it fails to properly restrict the scope of accessible objects, allowing specific potential...

org.thymeleaf:thymeleaf-spring3 (1.0.0-beta1) potentially affected by CVE-2026-40477 via org.thymeleaf:thymeleaf (1.0.0-beta1)

org.thymeleaf:thymeleaf MAVEN version 1.0.0-beta1 is affected by a known vulnerability. The following packages have a transitive dependency on org.thymeleaf:thymeleaf and may be impacted: - org.thymeleaf:thymeleaf-spring3 1.0.0-beta1 Source cves: CVE-2026-40477 Source advisory:...

net.sourceforge.pagesdialect:pagesdialect-core (1.0.0-beta2), org.thymeleaf:thymeleaf-spring3 (2.0.6) potentially affected by CVE-2026-40477 via org.thymeleaf:thymeleaf (2.0.6)

org.thymeleaf:thymeleaf MAVEN version 2.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.thymeleaf:thymeleaf and may be impacted: - net.sourceforge.pagesdialect:pagesdialect-core 1.0.0-beta2 - org.thymeleaf:thymeleaf-spring3 2.0.6 Source cves:...

PT-2026-33214

Name of the Vulnerable Software and Affected Versions Thymeleaf versions prior to 3.1.4.RELEASE Description A security bypass exists in the expression execution mechanisms. The library fails to properly restrict the scope of accessible objects, which allows specific sensitive objects to be reache...

PT-2026-33215

Name of the Vulnerable Software and Affected Versions Thymeleaf versions prior to 3.1.4.RELEASE Description A security bypass exists in the expression execution mechanisms of Thymeleaf, a server-side Java template engine. The library fails to properly neutralize specific syntax patterns, allowing...

CVE-2021-22053

Applications using both spring-cloud-netflix-hystrix-dashboard and spring-boot-starter-thymeleaf expose a way to execute code submitted within the request URI path during the resolution of view templates. When a request is made at /hystrix/monitor;user-provided data, the path elements following...

lab-xss

Cross-Site Scripting XSS Lab 🔒 Un laboratorio educativo com...

EUVD-2021-2380

Malware in sbrugna...

EUVD-2023-1989

Malicious code in bioql PyPI...

CVE-2023-38286

Thymeleaf through 3.1.1.RELEASE, as used in spring-boot-admin aka Spring Boot Admin through 3.1.1 and other products, allows sandbox bypass via crafted HTML. This may be relevant for SSTI Server Side Template Injection and code execution in spring-boot-admin if MailNotifier is enabled and there i...

CVE-2021-43466

In the thymeleaf-spring5:3.0.12 component, thymeleaf combined with specific scenarios in template injection may lead to remote code execution...

My-BBS security vulnerabilities

My-BBS is a SpringBoot + Mybatis + Thymeleaf technology implemented BBS forum system by ZHENFENG13 individual developer. A security vulnerability exists in My-BBS version 1.0, which stems from a cross-site request forgery issue...

My-BBS security vulnerabilities

My-BBS is a SpringBoot + Mybatis + Thymeleaf technology implemented BBS forum system by ZHENFENG13 individual developer. There is a security vulnerability in My-BBS version 1.0, which originates from the function Upload in the file src/main/java/com/my/bbs/controller/common/UploadController.java,...

Starsea-Mall code injection vulnerability

starsea-mall is a springboot +thymeleaf based Xiaomi mall management system by StarSea99 individual developer. A code injection vulnerability exists in starsea-mall version 1.0, which originates from cross-site scripting and may lead to remote attacks...

Starsea-Mall security vulnerabilities

starsea-mall is a springboot +thymeleaf based Xiaomi mall management system by StarSea99 individual developer. A security vulnerability exists in starsea-mall version 1.0, which stems from improper manipulation of the userId parameter, which may lead to improper access control...

Starsea-Mall code injection vulnerability

starsea-mall is a springboot +thymeleaf based Xiaomi mall management system by StarSea99 individual developer. A code injection vulnerability exists in starsea-mall version 1.0, which stems from improper manipulation of the redirectUrl parameter and could lead to cross-site scripting attacks...