CWE-1336
Improper Neutralization of Special Elements Used in a Template Engine
The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.
175 vulnerabilities with CWE-1336
CVE-2026-28697
CRITICAL
Craft CMS <4.17.0-beta.1/5.9.0-beta.1 - RCE
CVSS 9.1
CVE-2026-28695
HIGH
Craft CMS 5.8.21 - Authenticated RCE
CVSS 7.2
CVE-2026-26938
HIGH
Kibana - Authenticated Server-Side Request Forgery and Arbitrary File Read via Workflows Template Injection
CVSS 8.6
CVE-2026-27961
HIGH
Agenta < 0.86.8 - Server-Side Template Injection in Evaluator Template Rendering
CVSS 8.8
CVE-2026-27641
CRITICAL
Flask-Reuploaded <1.5.0 - Path Traversal
CVSS 9.8
CVE-2026-27629
MEDIUM
InvenTree < 1.2.3 - Authenticated Server-Side Template Injection via Batch Code Template
CVSS 5.9
CVE-2026-2969
MEDIUM
datapizza-ai 0.0.2 - Code Injection
CVSS 4.7
CVE-2026-27464
HIGH
Metabase <0.57.13/0.58.x-0.58.6 - Info Disclosure
CVSS 7.7
CVE-2026-1868
CRITICAL
GitLab AI Gateway <18.6.1-18.8.0 - DoS/Code Execution
CVSS 9.9
CVE-2026-25731
HIGH
calibre < 9.2.0 - Remote Code Execution via Templite Template Injection
CVSS 7.8
CVE-2026-25526
CRITICAL
JinJava 2.7.0-2.7.5 and 2.8.0-2.8.2 - Remote Code Execution via ForTag Sandbox Bypass
CVSS 9.8
CVE-2026-23626
MEDIUM
Kimai < 2.46.0 - Authenticated Information Disclosure via Twig Template Injection
CVSS 6.8
CVE-2026-22244
HIGH
OpenMetadata < 1.11.4 - Authenticated Remote Code Execution via FreeMarker Email Template Injection
CVSS 7.2
CVE-2026-21450
CRITICAL
Bagisto < 2.3.10 - Server-Side Template Injection via Type Parameter
CVSS 9.8
CVE-2026-21449
HIGH
Bagisto < 2.3.10 - Server-Side Template Injection via First and Last Name Fields
CVSS 8.8
CVE-2026-21448
CRITICAL
Bagisto < 2.3.10 - Server-Side Template Injection via Customer Address Field
CVSS 9.8
CVE-2025-40900
MEDIUM
Angular template injection in Reports in Guardian/CMC before 26.1.0
CVSS 4.6
CVE-2025-12107
HIGH
Velocity Template Engine - Code Injection
CVSS 8.4
CVE-2025-69516
HIGH
Amidaware Tactical RMM <=1.3.1 - SSTI
CVSS 8.8
CVE-2025-46699
MEDIUM
Dell Data Protection Advisor <19.12 - Info Disclosure
CVSS 4.3
CVE-2025-64087
CRITICAL
opensagres XDocReport <2.1.0 - SSTI
CVSS 9.8
CVE-2025-68454
HIGH
Craft CMS 4.0.0.1-4.16.16 and 5.0.0-RC1-5.8.20 - Authenticated Remote Code Execution via Twig SSTI
CVSS 8.8
CVE-2025-68929
CRITICAL
Frappe <14.99.6-15.88.1 - Authenticated RCE
CVSS 9.0
CVE-2025-67843
HIGH
Mintlify Platform <2025-11-15 - SSTI
CVSS 8.3
CVE-2025-14700
CRITICAL
Crafty Controller - Authenticated Remote Code Execution via Webhook Template Injection
CVSS 9.9
Details
Vulnerabilities
175