CWE-1336
Improper Neutralization of Special Elements Used in a Template Engine
The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.
175 vulnerabilities with CWE-1336
CVE-2024-24724
CRITICAL
Gibbon < 26.0.00 - Server-Side Template Injection via Messenger Settings
CVSS 9.8
CVE-2024-28116
HIGH
Grav < 1.7.45 - Authenticated Server-Side Template Injection
CVSS 8.8
CVE-2024-27623
MEDIUM
CMS Made Simple 2.2.19 - Server-Side Template Injection in Design Manager Breadcrumbs
CVSS 5.9
CVE-2023-6743
HIGH
Unlimited Elements For Elementor < 1.5.89 - Authenticated Remote Code Execution via Template Import
CVSS 8.8
CVE-2023-47542
MEDIUM
FortiManager <7.4.1, <7.2.4, <7.0.10 - Code Injection
CVSS 6.7
CVE-2023-5764
HIGH
Ansible < 2.14.12 and 2.16.0-2.16.1 - Template Injection via Unsafe Data Handling
CVSS 7.1
CVE-2023-6709
HIGH
mlflow/mlflow <2.9.2 - Info Disclosure
CVSS 8.8
CVE-2023-46245
HIGH
Kimai < 2.1.0 - Server-Side Template Injection and Remote Code Execution via Twig File Upload
CVSS 7.2
CVE-2023-41047
MEDIUM
OctoPrint <= 1.9.2 - Authenticated Remote Code Execution via GCODE Script Rendering
CVSS 6.2
CVE-2023-29297
CRITICAL
Adobe Commerce <= 2.4.6, <= 2.4.5-p2, <= 2.4.4-p3 - Authenticated Remote Code Execution via Template Injection
CVSS 9.1
CVE-2023-34448
HIGH
Grav < 1.7.42 - Server-Side Template Injection via Twig map() and reduce() Functions
CVSS 8.8
CVE-2023-34253
HIGH
Grav < 1.7.42 - Authenticated Remote Code Execution via Template Injection Denylist Bypass
CVSS 8.8
CVE-2023-34252
HIGH
Grav < 1.7.42 - Authenticated Remote Code Execution via Twig Filter Array Bypass
CVSS 8.8
CVE-2023-2259
HIGH
GitHub alfio-event/alf.io <2.0-M4-2304 - Info Disclosure
CVSS 7.2
CVE-2023-2017
HIGH
Shopware 6 <= v6.4.20.0,v6.5.0.0-rc1 <= v6.5.0.0-rc4 - Code Injection
CVSS 8.8
CVE-2023-27995
HIGH
Fortinet FortiSOAR 7.3.0-7.3.1 - Authenticated Remote Code Execution via Template Injection
CVSS 7.2
CVE-2022-23851
CRITICAL
Netaxis API Orchestrator <0.19.3 - SSRF
CVSS 9.8
CVE-2022-47896
MEDIUM
JetBrains IntelliJ IDEA <2022.3.1 - Code Injection
CVSS 5.0
CVE-2022-25813
HIGH
Apache OFBiz < 18.12.06 - Server-Side Template Injection via Ecommerce Contact Us Subject Field
CVSS 7.5
CVE-2022-27662
MEDIUM
F5 Traffix SDC <5.2.2, <5.1.35 - XSS
CVSS 4.8
CVE-2022-0944
HIGH
sqlpad < 6.10.1 - Remote Code Execution via Template Injection in Connection Test Endpoint
CVSS 7.2
CVE-2022-0896
HIGH
microweber/microweber <1.3 - Info Disclosure
CVSS 8.8
CVE-2022-0323
HIGH
Packagist mustache/mustache <2.14.1 - Info Disclosure
CVSS 8.8
CVE-2021-4315
MEDIUM
NYUCCL psiTurk <3.2.0 - Template Injection
CVSS 5.5
CVE-2021-39128
HIGH
Atlassian Jira Server/Data Center - RCE
CVSS 7.2
Details
Vulnerabilities
175