Base de CVEs

CVE-2026-21450 Crítica · 9.8 CWE-1336 02/01/2026

Bagisto has SSTI in parameter that can lead to RCE

Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection via type parameter, which can lead to remote code execution or another exploitation. Version 2.3.10 fixes the issue.

CVE-2026-21449 Alta · 8.8 CWE-1336 02/01/2026

Bagisto has SSTI via first and last name from low-privilege user (not admin)

Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection via first name and last name from a low-privilege user. Version 2.3.10 fixes the issue.

CVE-2026-21448 Crítica · 9.8 CWE-1336 02/01/2026

Bagisto has Normal & Blind SSTI from low-privilege user when ordering product

Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection. When a normal customer orders any product, in the `add address` step they can inject a value to run in admin view. The issue can lead to remote code execution. Version 2.3.10 contains a patch.

CVE-2025-68929 Crítica · 9.0 CWE-1336 29/12/2025

Frappe may be vulnerable remote code execution due to server-side template injection

Frappe is a full-stack web application framework. Prior to versions 14.99.6 and 15.88.1, an authenticated user with specific permissions could be tricked into accessing a specially crafted link. This could lead to a malicious template being executed on the server, resulting in remote code execution. Versions 14.99.6 and 15.88.1 fix the issue. No known workarounds are available.

CVE-2025-67843 Crítica · 9.8 CWE-1336 18/12/2025

A Server-Side Template Injection (SSTI) vulnerability in the MDX Rendering Engine in…

A Server-Side Template Injection (SSTI) vulnerability in the MDX Rendering Engine in Mintlify Platform before 2025-11-15 allows remote attackers to execute arbitrary code via inline JSX expressions in an MDX file.

CVE-2022-23851 Crítica · 9.8 CWE-1336 17/12/2025

Netaxis API Orchestrator (APIO) before 0.19.3 allows server side template injection…

Netaxis API Orchestrator (APIO) before 0.19.3 allows server side template injection (SSTI).

CVE-2025-14700 Crítica · 9.9 CWE-1336 16/12/2025

Improper Neutralization of Special Elements Used in a Template Engine in Crafty Controller

An input neutralization vulnerability in the Webhook Template component of Crafty Controller allows a remote, authenticated attacker to perform remote code execution via Server Side Template Injection.

CVE-2024-58303 Alta · 8.6 CWE-1336 11/12/2025

FoF Pretty Mail 1.1.2 Server Side Template Injection via Email Template Settings

FoF Pretty Mail 1.1.2 contains a server-side template injection vulnerability that allows administrative users to inject malicious code into email templates. Attackers can execute system commands by inserting crafted template expressions that trigger arbitrary code execution during email generation.

CVE-2024-58293 Alta · 8.6 CWE-1336 11/12/2025

Akaunting 3.1.8 Server-Side Template Injection via Multiple Form Fields

Akaunting 3.1.8 contains a server-side template injection vulnerability that allows authenticated administrators to execute template expressions in multiple form input fields. Attackers can inject template payloads in items, taxes, transactions, and vendor name fields to perform arithmetic operations and string manipulations.

CVE-2025-66298 Alta · 7.5 CWE-1336 01/12/2025

Grav is vulnerable to Server-Side Template Injection (SSTI) via Forms

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, having a simple form on site can reveal the whole Grav configuration details (including plugin configuration details) by using the correct POST payload to exploit a Server-Side Template (SST) vulnerability. Sensitive information may be contained in the configuration details. This vulnerability is fixed in 1.8.0-beta.27.

CVE-2025-66297 Alta · 8.8 CWE-1336 01/12/2025

Grav vulnerable to Privilege Escalation and Authenticated Remote Code Execution via Twig Injection

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a user with admin panel access and permissions to create or edit pages in Grav CMS can enable Twig processing in the page frontmatter. By injecting malicious Twig expressions, the user can escalate their privileges to admin or execute arbitrary system commands via the scheduler API. This results in both Privilege Escalation (PE) and Remote Code Execution (RCE) vulnerabilities. This vulnerability is fixed in 1.8.0-beta.27.

CVE-2025-66361 Média · 6.5 CWE-1336 27/11/2025

An issue was discovered in Logpoint before 7.7.0. Sensitive information is exposed in…

An issue was discovered in Logpoint before 7.7.0. Sensitive information is exposed in System Processes for an extended period during high CPU load.

CVE-2025-65106 Alta · 8.3 CWE-1336 21/11/2025

LangChain Vulnerable to Template Injection via Attribute Access in Prompt Templates

LangChain is a framework for building agents and LLM-powered applications. From versions 0.3.79 and prior and 1.0.0 to 1.0.6, a template injection vulnerability exists in LangChain's prompt template system that allows attackers to access Python object internals through template syntax. This vulnerability affects applications that accept untrusted template strings (not just template variables) in ChatPromptTemplate and related prompt template classes. This issue has been patched in versions 0.3.80 and 1.0.7.

CVE-2025-60355 Crítica · 9.8 CWE-1336 28/10/2025

zhangyd-c OneBlog v2.3.9 and before was vulnerable to SSTI (Server-Side Template…

zhangyd-c OneBlog v2.3.9 and before was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates.

CVE-2025-37729 Alta · 7.2 CWE-1336 13/10/2025

Elastic Cloud Enterprise (ECE) Improper Neutralization of Special Elements Used in a Template Engine

Improper neutralization of special elements used in a template engine in Elastic Cloud Enterprise (ECE) can lead to a malicious actor with Admin access exfiltrating sensitive information and issuing commands via a specially crafted string where Jinjava variables are evaluated.

CVE-2025-54287 Média · 6.5 CWE-1336 02/10/2025

Arbitrary File Read via Template Injection in Snapshot Patterns

Template Injection in instance snapshot creation component in Canonical LXD (>= 4.0) allows an attacker with instance configuration permissions to read arbitrary files on the host system via specially crafted snapshot pattern templates using the Pongo2 template engine.

CVE-2025-10380 Alta · 8.8 CWE-1336 23/09/2025

Advanced Views – Display Posts, Custom Fields, and More <= 3.7.19 - Authenticated (Author+) Remote Code Execution via SSTI

The Advanced Views – Display Posts, Custom Fields, and More plugin for WordPress is vulnerable to Server-Side Template Injection in all versions up to, and including, 3.7.19. This is due to insufficient input sanitization and lack of access control when processing custom Twig templates in the Model panel. This makes it possible for authenticated attackers, with author-level access or higher, to execute arbitrary PHP code and commands on the server.