ssti vulnerabilities and exploits

(subscribe to this query)

On versions prior to 2.1.4, a user could log in and perform a template injection attack resulting in Remote Code Execution on the server, The attacker must successfully log into the system to launch an attack, so this is a moderate-impact vulnerability. Mitigation: all users shou...

Apache Streampark

A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated malicious user to achieve RCE on an affected instance. Customers using an affected version must take immediate action. Most recent supported versions of Confluence ...

Atlassian Confluence Data Center 8.7.0 Atlassian Confluence Data Center Atlassian Confluence Server

1 Metasploit module30 Github repositories2 Articles

Improper Control of Generation of Code ('Code Injection'), Cross-Site Request Forgery (CSRF), : Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz. This issue affects Apache OFBiz: prior to 18.12.17. Users are recommended...

Hitachi Vantara Pentaho Business Analytics Server versions prior to 9.4.0.1 and 9.3.0.2, including 8.3.x contain security restrictions using non-canonical URLs which can be circumvented.

Hitachi Vantara Pentaho Business Analytics Server Hitachi Vantara Pentaho Business Analytics Server 9.4.0.0

1 Metasploit module

Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow certain web services to set property values which contain Spring templates that are interpreted downstream.

Hitachi Vantara Pentaho Business Analytics Server 9.4.0.0 Hitachi Vantara Pentaho Business Analytics Server

1 Metasploit module

Bagisto v1.5.1 is vulnerable to Server-Side Template Injection (SSTI).

Webkul Bagisto 1.5.1

1 Github repository

FileSender prior to 2.49 allows server-side template injection (SSTI) for retrieving credentials.

In JetBrains IntelliJ IDEA prior to 2022.3.1 code Templates were vulnerable to SSTI attacks.

Jetbrains Intellij Idea

JetBrains YouTrack prior to 2021.4.40426 was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates.

Jetbrains Youtrack

1 Github repository

The member center function in fastadmin V1.0.0.20200506_beta is vulnerable to a Server-Side Template Injection (SSTI) vulnerability.

Fastadmin Fastadmin 1.0.0.20200506

1 2 3 4 5 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Product List Vendor List Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook