Search Vulnerabilities

Tugtainer has Server-Side Template Injection in notification templates that leads to Remote Code Execution

MeltanoHub vulnerable to command injection in the `test_dispatcher` GitHub Actions workflow

Gitleaks Secret Exfiltration via Non-Hermetic Sprig Template Functions in Report Template Feature

Jupyter Enterprise Gateway: Jinja2 Template Server Side Template Injection results in Remote Code Execution

ERPNext: Server-Side Template Injection (SSTI) in Batch autonaming via Stock Settings.naming_series_prefix

Craft CMS: Potential authenticated Remote Code Execution via referrer redirect

Gogs: DoS in rendering issue index pattern

FOSSBilling: Server-side template injection in Twig template rendering enables information disclosure and RCE

JTL Shop < 5.7.2 Server-Side Template Injection via Smarty Renderer

Pimcore CMS 12.3.8 Twig Sandbox Bypass via SecurityPolicy checkMethodAllowed

Tautulli Vulnerable to Unauthenticated/Authenticated Remote Code Execution via Newsletter Custom Template Directory

Server-Side Template Injection (SSTI) in Wirtualna Uczelnia

Apache Airflow: BashOperator Jinja2 injection via dag_run.conf — low-privilege user pattern

Formie: Pre-authenticated server-side template injection in Hidden fields

In JetBrains IntelliJ IDEA before 2026

RAGFlow: Server-Side Template Injection in Prompt Generator leads to Remote Code Execution

A Server-Side Template Injection (SSTI) vulnerability exists in Mautic's theme engine

Banks: Critical Remote Code Execution (RCE) via Jinja2 SSTI

Vowpal Wabbit: Shell injection via crafted PR title in python_checks.yml allows arbitrary command execution on CI runner

Dromara lamp-cloud Message Template GroovyClassLoader.parseClass special elements used in a template engine