CWE-791: Incomplete Filtering of Special Elements
The product receives data from an upstream component, but it does not completely filter special elements before sending it to a downstream component.
A kind of CWE-790 Improper Filtering of Special Elements.
From the CWE List. © The MITRE Corporation.
Newest
- eosphoros-ai db-gpt eosphoros-ai DB-GPT Jinja2 Template __init__.py FileBasedSkill.get_prompt special elements in template engine 5.3 Medium
- darylldoyle svg-sanitizer svg-sanitizer 0.5.0 before 1.1.0 Incomplete url() Filtering in SVG Attributes 5.3 Medium
- furion .net framework Furion .NET Framework View ViewEngine.cs RunCompile special elements in template engine 5.3 Medium
- formtools.org form tools formtools.org Form Tools Client Settings Clients.class.php updateClientSettingsTab special elements in template engine 5.3 Medium
- naichen thinkcmf Naichen ThinkCMF Email Template MailController.php templatePut special elements in template engine 5.1 Medium
- n-able n-central Access control filter bypass allows unauthorised access to APIs 6.9 Medium
- dromara ujcms Dromara UJCMS web-file-template Endpoint WebFileTemplateController.java update special elements in template engine 5.1 Medium
- xianrendzw easyreport xianrendzw EasyReport SQL Preview Endpoint DesignerController.java previewSqlText special elements in template engine 5.3 Medium
- No product listed OpenBoxes Template Processing DocumentController.groovy buildZebraTemplate special elements in template engine 5.3 Medium
- langgenius dify langgenius dify Jinja2 jinja2_transformer.py jinja2.Template special elements used in a template engine 5.3 Medium
- otrs, otrs ag ((otrs)) community edition +1 more Denial-of-Service via SVG Rendering in Ticket 6.5 Medium
- dromara lamp-cloud Dromara lamp-cloud Message Template GroovyClassLoader.parseClass special elements used in a template engine 5.3 Medium
- apache camel, red hat openshift serverless, build of apache camel 4 for quarkus 3 +4 more +6 more Apache Camel: Camel-CXF Message Header Injection via Missing Inbound Filtering 9.8 Critical
- sanluan publiccms Sanluan PublicCMS templateResult API TemplateResultDirective.java execute special elements used in a template engine 5.3 Medium
- hackingrepo dssrf-js dssrf: every IPv6 category bypasses is_url_safe 8.7 High
- freebsd pf can overflow the stack parsing crafted SCTP packets 7.5 High
-
github.com/tinfoil-factory/netfoilGo netfoil's optional seccomp sandboxing was not applied 6.9 Medium - astrbotdevs astrbot AstrBotDevs AstrBot Dashboard API t2i.py create_template special elements used in a template engine 5.1 Medium
- sanluan publiccms Sanluan PublicCMS FreeMarker Template AbstractFreemarkerView.java AbstractFreemarkerView.doRender special elements used in a template engine 5.1 Medium
- antaresmugisho pyblade AntaresMugisho PyBlade AST Validation sandbox.py _is_safe_ast special elements used in a template engine 5.3 Medium
- 1024-lab smartadmin 1024-lab/lab1024 SmartAdmin FreeMarker Template MailService.java freemarkerResolverContent special elements used in a template engine 5.3 Medium
- opencart OpenCart Incomplete Fix CVE-2024-36694 template.php save special elements used in a template engine 5.1 Medium
- backstage, linuxfoundation backstage plugin-techdocs-node, red hat developer hub 1.8 +2 more +4 more @backstage/plugin-techdocs-node: TechDocs Mkdocs Configuration Key Enables Arbitrary Code Execution 7.7 High
- datapizza ai, datapizza-labs datapizza-ai +1 more datapizza-labs datapizza-ai Jinja2 Template prompt.py ChatPromptTemplate special elements used in a template engine 5.1 Medium
- code-projects content management system, ctcms project ctcms +1 more CTCMS Content Management System Frontend/Template Management CT_Parser.php special elements used in a template engine 5.3 Medium
- haproxy kubernetes ingress controller HAProxy Kubernetes Ingress Controller before 3.1.13, when the config-snippets feature flag is... 6.4 Medium
- thingsboard ThingsBoard Add Gateway special elements used in a template engine 5.3 Medium
- kingdee cloud-starry-sky enterprise edition Kingdee Cloud-Starry-Sky Enterprise Edition Freemarker Engine DynamicForm 4 Action.class plugin.buildMobilePopHtml special elements used in a template engine 6.9 Medium
- pyspur-dev pyspur PySpur-Dev pyspur Jinja2 Template single_llm_call.py SingleLLMCallNode special elements used in a template engine 5.3 Medium
- google angularjs AngularJS improper sanitization in SVG '<image>' element with 'ngSanitize' 4.8 Medium
- axis os, os 2024 +1 more The VAPIX Device Configuration framework allowed a privilege escalation, enabling a lower... 9.4 Critical
- zhilink adp application developer platform, zhilink 智互联(深圳)科技有限公司 adp application developer platform 应用开发者平台 +1 more zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 testService special elements used in a template engine 5.3 Medium
- wix jam wix-incubator jam Jinja2 Template jam.py special elements used in a template engine 4.8 Medium
- b&r industrial automation aprol Improper authentication in SSH of B&R APROL 8.5 High
- iocoder ruoyi-vue-pro zhijiantianya ruoyi-vue-pro deploy special elements used in a template engine 5.3 Medium
- sap web dispatcher Cross-Site Scripting (XSS) vulnerability in SAP Web Dispatcher 8.8 High
- intel tdx module, tdx module software +1 more Incomplete filtering of special elements in Intel(R) TDX module software before version TDX_1.5... 8.5 High
- weimengcms wmcms An issue in the DelFile() function of WMCMS v4.4 allows attackers to delete arbitrary files via a... 7.5 High
- privatebin PrivateBin allows shortening of URLs for other domains 5.3 Medium
- cmseasy CMSeasy 7.7.7.9 is vulnerable to Arbitrary file deletion. 4.3 Medium
- No product listed The XAO::Web module before 1.84 for Perl mishandles < and > characters in JSON output during use... 5.4 Medium
- schweitzer engineering laboratories sel-5030 acselerator quickset software, selinc sel-5030 acselerator quickset +1 more Incomplete Filtering of Special Elements 5.9 Medium
- linux kernel A flaw was found in the Linux Kernel. The tun/tap sockets have their socket UID hardcoded to 0... 5.5 Medium
- [unknown] dpdk, debian linux, dpdk data plane development kit +6 more +8 more A permissive list of allowed inputs flaw was found in DPDK. This issue allows a remote attacker... 8.6 High
- pypa pipenv, fedoraproject fedora +1 more Pipenv's requirements.txt parsing allows malicious index url in comments 8.0 High
- google angularjs, red hat enterprise linux 10, enterprise linux 7 +7 more +9 more AngularJS XSS via SCE resource URL sanitization bypass 7.6 High
- google angularjs AngularJS improper sanitization in SVG '<image>' element 4.8 Medium
- angularjs, angularjs angular.js, netapp active iq unified manager +2 more AngularJS improper sanitization in '<source>' element 4.8 Medium