xiandafu

3 exploits Active since Dec 2022
CVE-2024-22533 GITEE CRITICAL java
Before Beetl <3.15.12 - Code Injection
Before Beetl v3.15.12, the rendering template has a server-side template injection (SSTI) vulnerability. When the incoming template is controllable, it will be filtered by the DefaultNativeSecurityManager blacklist. Because blacklist filtering is not strict, the blacklist can be bypassed, leading to arbitrary code execution.
643 stars
CVSS 9.8
CVE-2023-30331 GITEE CRITICAL java
beetl 3.15.0 - Server-Side Template Injection via Render Function
An issue in the render function of beetl v3.15.0 allows attackers to execute server-side template injection (SSTI) via a crafted payload.
643 stars
CVSS 9.8
CVE-2022-4347 GITEE LOW java
beetl-bbs - Cross-Site Scripting via User Argument in WebUtils.java
A vulnerability was found in xiandafu beetl-bbs. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file WebUtils.java. The manipulation of the argument user leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-215107.
546 stars
CVSS 3.5