CWE-1336: Server-Side Template Injection / SSTI
The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.
Also known as Improper Neutralization of Special Elements Used in a Template Engine, Client-Side Template Injection / CSTI.
A kind of CWE-94 Improper Control of Generation of Code.
From the CWE List. © The MITRE Corporation.
Newest
- getgrav gravServer-Side Template Injection (SSTI) with Grav CMS security sandbox bypass8.8 High
- cmsmadesimple cms made simpleCMS Made Simple version 2.2.19 is vulnerable to Server-Side Template Injection (SSTI). The...5.9 Medium
- nonebot, nonebot nonebot2 +1 morePotential Information Leak in User-Constructed Message Templates in nonebot25.7 Medium
- redhat ansible, fedoraproject extra packages for enterprise linux, fedora +6 more +8 moreAnsible: template injection7.1 High
- lfprojects mlflow, mlflow mlflow/mlflow +1 moreImproper Neutralization of Special Elements Used in a Template Engine in mlflow/mlflow10.0 Critical
- kimaiKimai (Authenticated) SSTI to RCE by Uploading a Malicious Twig File7.2 High
- octoprintImproper Neutralization of Special Elements Used in a Template Engine in OctoPrint6.2 Medium
- adobe commerce, magento, magento commerce +2 moreAdmin-to-admin stored XSS via cache poisoning9.1 Critical
- getgrav gravGrav Server-side Template Injection (SSTI) via Twig Default Filters8.8 High
- getgrav gravGrav vulnerable to Server-side Template Injection (SSTI) via Denylist Bypass8.8 High
- getgrav gravGrav Server-side Template Injection via Insufficient Validation in filterFilter8.8 High
- alf, alfio-event alfio-event/alf.io +1 moreImproper Neutralization of Special Elements Used in a Template Engine in alfio-event/alf.io9.1 Critical
- shopware, shopware ag 6 +1 moreImproper Control of Generation of Code in Twig Rendered Views in Shopware8.8 High
- fortinet fortisoarA improper neutralization of special elements used in a template engine vulnerability in Fortinet...7.2 High
- nyuccl psiturkNYUCCL psiTurk experiment.py special elements used in a template engine5.5 Medium
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2022.3.1 code Templates were vulnerable to SSTI attacks.5.0 Medium
- apache ofbizServer-Side Template Injection affecting the ecommerce plugin of Apache OFBiz7.5 High
- f5 traffix sdc, traffix signaling delivery controller +1 moreOn F5 Traffix SDC 5.2.x versions prior to 5.2.2 and 5.1.x versions prior to 5.1.35, a stored...4.8 Medium
- sqlpad, sqlpad sqlpad/sqlpad +1 moreTemplate injection in connection test endpoint leads to RCE in sqlpad/sqlpad9.1 Critical
- microweber, microweber microweber/microweber +1 moreImproper Neutralization of Special Elements Used in a Template Engine in microweber/microweber7.1 High
- razorengine project razorengineCode injection in RazorEngine9.8 Critical
- bobthecow bobthecow/mustache.php, mustache project mustache +1 moreImproper Neutralization of Special Elements Used in a Template Engine in bobthecow/mustache.php5.3 Medium
- mingsoft mcmsRCE in Mingsoft MCMS9.8 Critical
- atlassian jira server, jira data center +1 moreAffected versions of Atlassian Jira Server or Data Center using the Jira Service Management addon...7.2 High
- craftcms craft cmsCraft CMS Vulnerable to Server-Side Template Injection7.2 High