CWE-1336 · Improper Neutralization of Special Elements Used in a Template Engine (page 2)
Page 2 of 3 — CVEs classified under CWE-1336, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-64087 | Critical | 9.8 | 2026-01-20 | A Server-Side Template Injection (SSTI) vulnerability in the FreeMarker component of opensagres XDocReport v1.0.0 to v2.1.0 allows attackers to execute arbitra… |
CVE-2026-23626 | Medium | 6.8 | 2026-01-18 | Kimai is a web-based multi-user time-tracking application. Prior to version 2.46.0, Kimai's export functionality uses a Twig sandbox with an overly permissive… |
CVE-2026-22244 | High | 7.2 | 2026-01-08 | OpenMetadata is a unified metadata platform. Versions prior to 1.11.4 are vulnerable to remote code execution via Server-Side Template Injection (SSTI) in Free… |
CVE-2025-68454 | High | 8.8 | 2026-01-05 | Craft is a platform for creating digital experiences. Versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16 are vulnerable to potential authenticated… |
CVE-2026-21450 | Critical | 9.8 | 2026-01-02 | Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection via type parameter, which can l… |
CVE-2026-21449 | High | 8.8 | 2026-01-02 | Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection via first name and last name fr… |
CVE-2026-21448 | Critical | 9.8 | 2026-01-02 | Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection. When a normal customer orders… |
CVE-2025-68929 | Critical | 9.0 | 2025-12-29 | Frappe is a full-stack web application framework. Prior to versions 14.99.6 and 15.88.1, an authenticated user with specific permissions could be tricked into… |
CVE-2025-67843 | High | 8.3 | 2025-12-19 | A Server-Side Template Injection (SSTI) vulnerability in the MDX Rendering Engine in Mintlify Platform before 2025-11-15 allows remote attackers to execute arb… |
CVE-2022-23851 | Critical | 9.8 | 2025-12-17 | Netaxis API Orchestrator (APIO) before 0.19.3 allows server side template injection (SSTI). |
CVE-2025-14700 | Critical | 9.9 | 2025-12-17 | An input neutralization vulnerability in the Webhook Template component of Crafty Controller allows a remote, authenticated attacker to perform remote code exe… |
CVE-2025-14731 | Medium | 6.3 | 2025-12-16 | A weakness has been identified in CTCMS Content Management System up to 2.1.2. This affects an unknown function in the library /ctcms/apps/libraries/CT_Parser… |
CVE-2025-66438 | High | 8.8 | 2025-12-15 | A Server-Side Template Injection (SSTI) vulnerability exists in the Frappe ERPNext through 15.89.0 Print Format rendering mechanism. Specifically, the API frap… |
CVE-2025-66437 | High | 8.8 | 2025-12-15 | An SSTI (Server-Side Template Injection) vulnerability exists in the get_address_display method of Frappe ERPNext through 15.89.0. This function renders addres… |
CVE-2025-66436 | Medium | 4.3 | 2025-12-15 | An SSTI (Server-Side Template Injection) vulnerability exists in the get_terms_and_conditions method of Frappe ERPNext through 15.89.0. The function renders at… |
CVE-2025-66435 | Medium | 4.3 | 2025-12-15 | An SSTI (Server-Side Template Injection) vulnerability exists in the get_contract_template method of Frappe ERPNext through 15.89.0. The function renders attac… |
CVE-2025-66434 | High | 8.8 | 2025-12-15 | An SSTI (Server-Side Template Injection) vulnerability exists in the get_dunning_letter_text method of Frappe ERPNext through 15.89.0. The function renders att… |
CVE-2024-58303 | | 2025-12-11 | FoF Pretty Mail 1.1.2 contains a server-side template injection vulnerability that allows administrative users to inject malicious code into email templates. A… | |
CVE-2024-58293 | | 2025-12-11 | Akaunting 3.1.8 contains a server-side template injection vulnerability that allows authenticated administrators to execute template expressions in multiple fo… | |
CVE-2025-65602 | Critical | 9.8 | 2025-12-10 | A template injection vulnerability in the /vip/v1/file/save component of ChanCMS v3.3.4 allows attackers to execute arbitrary code via a crafted POST request. |
CVE-2025-66299 | High | 8.8 | 2025-12-01 | Grav is a file-based Web platform. Prior to 1.8.0-beta.27, Grav CMS is vulnerable to a Server-Side Template Injection (SSTI) that allows any authenticated user… |
CVE-2025-66298 | High | 7.5 | 2025-12-01 | Grav is a file-based Web platform. Prior to 1.8.0-beta.27, having a simple form on site can reveal the whole Grav configuration details (including plugin confi… |
CVE-2025-66297 | High | 8.8 | 2025-12-01 | Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a user with admin panel access and permissions to create or edit pages in Grav CMS can enable Twig p… |
CVE-2025-66294 | High | 8.8 | 2025-12-01 | Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a Server-Side Template Injection (SSTI) vulnerability exists in Grav that allows authenticated attac… |
CVE-2025-66361 | Medium | 6.5 | 2025-11-28 | An issue was discovered in Logpoint before 7.7.0. Sensitive information is exposed in System Processes for an extended period during high CPU load. |
CVE-2025-65106 | | 2025-11-21 | LangChain is a framework for building agents and LLM-powered applications. From versions 0.3.79 and prior and 1.0.0 to 1.0.6, a template injection vulnerabilit… | |
CVE-2025-62369 | High | 7.2 | 2025-11-04 | Xibo is an open source digital signage platform with a web content management system (CMS). Versions 4.3.0 and below contain a Remote Code Execution vulnerabil… |
CVE-2025-60355 | Critical | 9.8 | 2025-10-28 | zhangyd-c OneBlog v2.3.9 and before was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates. |
CVE-2025-62416 | Medium | 5.1 | 2025-10-16 | Bagisto is an open source laravel eCommerce platform. Bagisto v2.3.7 is vulnerable to Server-Side Template Injection (SSTI) due to unsanitized user input being… |
CVE-2025-37729 | Critical | 9.1 | 2025-10-13 | Improper neutralization of special elements used in a template engine in Elastic Cloud Enterprise (ECE) can lead to a malicious actor with Admin access exfiltr… |
CVE-2025-54287 | Medium | 6.5 | 2025-10-02 | Template Injection in instance snapshot creation component in Canonical LXD (>= 4.0) allows an attacker with instance configuration permissions to read arbitr… |
CVE-2025-10380 | High | 8.8 | 2025-09-23 | The Advanced Views – Display Posts, Custom Fields, and More plugin for WordPress is vulnerable to Server-Side Template Injection in all versions up to, and inc… |
CVE-2025-59340 | Critical | 9.8 | 2025-09-17 | jinjava is a Java-based template engine based on django template syntax, adapted to render jinja templates. Priori to 2.8.1, by using mapper.getTypeFactory().c… |
CVE-2025-52122 | Critical | 9.8 | 2025-08-27 | Freeform 5.0.0 to before 5.10.16, a plugin for CraftCMS, contains an Server-side template injection (SSTI) vulnerability, resulting in arbitrary code injection… |
CVE-2025-35113 | Medium | 5.9 | 2025-08-26 | Agiloft Release 28 does not properly neutralize special elements used in an EUI template engine, allowing an authenticated attacker to achieve remote code exec… |
CVE-2025-57811 | High | 7.2 | 2025-08-25 | Craft is a platform for creating digital experiences. From versions 4.0.0-RC1 to 4.16.5 and 5.0.0-RC1 to 5.8.6, there is a potential remote code execution vuln… |
CVE-2025-9094 | Medium | 4.3 | 2025-08-17 | A vulnerability was detected in ThingsBoard 4.1. This vulnerability affects unknown code of the component Add Gateway Handler. The manipulation leads to improp… |
CVE-2025-53909 | Critical | 9.1 | 2025-07-17 | mailcow: dockerized is an open source groupware/email suite based on docker. A Server-Side Template Injection (SSTI) vulnerability exists in versions prior to… |
CVE-2025-34300 | | 2025-07-16 | A template injection vulnerability exists in Sawtooth Software’s Lighthouse Studio versions prior to 9.16.14 via the ciwweb.pl http://ciwweb.pl/ Perl web app… | |
CVE-2025-49828 | High | 8.8 | 2025-07-15 | Conjur provides secrets management and application identity for infrastructure. Conjur OSS versions 1.19.5 through 1.21.1 and Secrets Manager, Self-Hosted (for… |
CVE-2025-53833 | Critical | 10.0 | 2025-07-14 | LaRecipe is an application that allows users to create documentation with Markdown inside a Laravel app. Versions prior to 2.8.1 are vulnerable to Server-Side… |
CVE-2025-6761 | High | 7.3 | 2025-06-27 | A vulnerability was found in Kingdee Cloud-Starry-Sky Enterprise Edition 6.x/7.x/8.x/9.0. It has been rated as critical. Affected by this issue is the function… |
CVE-2025-6518 | Medium | 6.3 | 2025-06-23 | A vulnerability was found in PySpur-Dev pyspur up to 0.1.18. It has been classified as critical. Affected is the function SingleLLMCallNode of the file backend… |
CVE-2025-49142 | High | 7.1 | 2025-06-10 | Nautobot is a Network Source of Truth and Network Automation Platform. All users of Nautobot versions prior to 2.4.10 or prior to 1.6.32 are potentially affect… |
CVE-2025-49136 | Critical | 9.0 | 2025-06-09 | listmonk is a standalone, self-hosted, newsletter and mailing list manager. Starting in version 4.0.0 and prior to version 5.0.2, the `env` and `expandenv` tem… |
CVE-2025-49619 | High | 8.5 | 2025-06-07 | Skyvern through 0.1.85 is vulnerable to server-side template injection (SSTI) in the Prompt field of workflow blocks such as the Navigation v2 Block. Improper… |
CVE-2025-5325 | Medium | 6.3 | 2025-05-29 | A vulnerability has been found in zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 1.0.0 and classified as critical. Affected by this vulnerabi… |
CVE-2025-47916 | Critical | 10.0 | 2025-05-16 | Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php. The issue lies within the themeeditor contr… |
CVE-2025-46731 | High | 7.2 | 2025-05-05 | Craft is a content management system. Versions of Craft CMS on the 4.x branch prior to 4.14.13 and on the 5.x branch prior to 5.6.16 contains a potential remot… |
CVE-2025-23376 | Low | 2.3 | 2025-04-28 | Dell PowerProtect Data Manager Reporting, version(s) 19.16, 19.17, 19.18, contain(s) an Improper Neutralization of Special Elements Used in a Template Engine v… |
CVE-2025-46661 | Critical | 10.0 | 2025-04-28 | IPW Systems Metazo through 8.1.3 allows unauthenticated Remote Code Execution because smartyValidator.php enables the attacker to provide template expressions… |
CVE-2025-3841 | Low | 3.3 | 2025-04-21 | A vulnerability, which was classified as problematic, was found in wix-incubator jam up to e87a6fd85cf8fb5ff37b62b2d68f917219d07ae9. This affects an unknown pa… |
CVE-2025-32461 | Critical | 9.9 | 2025-04-09 | wikiplugin_includetpl in lib/wiki-plugins/wikiplugin_includetpl.php in Tiki before 28.3 mishandles input to an eval. The fixed versions are 21.12, 24.8, 27.2… |
CVE-2025-1040 | High | 8.8 | 2025-03-20 | AutoGPT versions 0.3.4 and earlier are vulnerable to a Server-Side Template Injection (SSTI) that could lead to Remote Code Execution (RCE). The vulnerability… |
CVE-2024-8238 | High | 8.1 | 2025-03-20 | In version 3.22.0 of aimhubio/aim, the AimQL query language uses an outdated version of the safer_getattr() function from RestrictedPython. This version does n… |
CVE-2025-26865 | Low | 3.5 | 2025-03-10 | Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz. This issue affects Apache OFBiz: from 18.12.17 before 18… |
CVE-2025-2040 | Medium | 6.3 | 2025-03-06 | A vulnerability classified as critical was found in zhijiantianya ruoyi-vue-pro 2.4.1. Affected by this vulnerability is an unknown functionality of the file /… |
CVE-2025-27516 | High | 8.8 | 2025-03-05 | Jinja is an extensible templating engine. Prior to 3.1.6, an oversight in how the Jinja sandboxed environment interacts with the |attr filter allows an attacke… |
CVE-2024-9150 | | 2025-02-21 | Report generation functionality in Wyn Enterprise allows for code inclusion, but not sufficiently limits what code might be included. An attacker is able use a… | |
CVE-2025-26789 | | 2025-02-14 | An issue was discovered in Logpoint AgentX before 1.5.0. A vulnerability caused by limited access controls allowed li-admin users to access sensitive informati… | |
CVE-2024-57177 | High | 7.3 | 2025-02-10 | A host header injection vulnerability exists in the NPM package of perfood/couch-auth <= 0.21.2. By sending a specially crafted host header in the email change… |
CVE-2024-54954 | High | 8.0 | 2025-02-10 | OneBlog v2.3.6 was discovered to contain a template injection vulnerability via the template management department. |
CVE-2025-23211 | Critical | 9.9 | 2025-01-28 | Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. A Jinja2 SSTI vulnerability allows any user to execute com… |
CVE-2024-12583 | Critical | 9.9 | 2025-01-04 | The Dynamics 365 Integration plugin for WordPress is vulnerable to Remote Code Execution and Arbitrary File Read in all versions up to, and including, 1.3.23 v… |
CVE-2024-56326 | High | 7.8 | 2024-12-23 | Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker th… |
CVE-2024-55660 | Critical | 9.8 | 2024-12-12 | SiYuan is a personal knowledge management system. Prior to version 3.1.16, SiYuan's `/api/template/renderSprig` endpoint is vulnerable to Server-Side Template… |
CVE-2024-55652 | Medium | 6.5 | 2024-12-12 | PenDoc is a penetration testing reporting application. Prior to commit 1d4219c596f4f518798492e48386a20c6e9a2fe6, an attacker can write a malicious docx templat… |
CVE-2024-30372 | Medium | 6.3 | 2024-11-22 | Allegra getLinkText Server-Side Template Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on… |
CVE-2024-48962 | High | 8.8 | 2024-11-18 | Improper Control of Generation of Code ('Code Injection'), Cross-Site Request Forgery (CSRF), : Improper Neutralization of Special Elements Used in a Template… |
CVE-2024-39766 | High | 7.0 | 2024-11-13 | Improper neutralization of special elements used in SQL command in some Intel(R) Neural Compressor software before version v3.0 may allow an authenticated user… |
CVE-2024-46366 | High | 8.8 | 2024-09-27 | A Client-side Template Injection (CSTI) vulnerability in Webkul Krayin CRM 1.3.0 allows remote attackers to execute arbitrary client-side template code by inje… |
CVE-2024-45053 | Critical | 9.1 | 2024-09-04 | Fides is an open-source privacy engineering platform. Starting in version 2.19.0 and prior to version 2.44.0, the Email Templating feature uses Jinja2 without… |
CVE-2024-6386 | Critical | 9.9 | 2024-08-21 | The WPML plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.6.12 via Twig Server-Side Template Injection. This… |
CVE-2024-42356 | High | 8.3 | 2024-08-08 | Shopware is an open commerce platform. Prior to versions 6.6.5.1 and 6.5.8.13, the `context` variable is injected into almost any Twig Template and allows to a… |
CVE-2024-42355 | High | 8.3 | 2024-08-08 | Shopware, an open ecommerce platform, has a new Twig Tag `sw_silent_feature_call` which silences deprecation messages while triggered in this tag. Prior to ver… |
CVE-2024-41950 | High | 7.5 | 2024-07-31 | Haystack is an end-to-end LLM framework that allows you to build applications powered by LLMs, Transformer models, vector search and more. Haystack clients tha… |
CVE-2024-38363 | High | 8.5 | 2024-07-09 | Airbyte is a data integration platform for ELT pipelines. Airbyte connection builder docker image is vulnerable to RCE via SSTI which allows an authenticated r… |
CVE-2024-37621 | High | 7.2 | 2024-06-17 | StrongShop v1.0 was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the component /shippingOptionConfig/index.blade.php. |
CVE-2024-37301 | High | 7.2 | 2024-06-11 | Document Merge Service is a document template merge service providing an API to manage templates and merge them with given data. Versions 6.5.1 and prior are v… |
CVE-2024-23692 | Critical | 9.8 | 2024-05-31 | Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. This vulnerability allows a remote, unauthenti… |
CVE-2023-6743 | High | 8.8 | 2024-05-29 | The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and i… |
CVE-2024-34710 | High | 7.1 | 2024-05-20 | Wiki.js is al wiki app built on Node.js. Client side template injection was discovered, that could allow an attacker to inject malicious JavaScript into the co… |
CVE-2024-35191 | Medium | 4.4 | 2024-05-20 | Formie is a Craft CMS plugin for creating forms. Prior to 2.1.6, users with access to a form's settings can include malicious Twig code into fields that suppor… |
CVE-2024-32406 | High | 7.5 | 2024-04-26 | Server-Side Template Injection (SSTI) vulnerability in inducer relate before v.2024.1 allows a remote attacker to execute arbitrary code via a crafted payload… |
CVE-2024-32651 | Critical | 10.0 | 2024-04-26 | changedetection.io is an open source web page change detection, website watcher, restock monitor and notification service. There is a Server Side Template Inje… |
CVE-2024-25624 | Medium | 6.8 | 2024-04-25 | Iris is a web collaborative platform aiming to help incident responders sharing technical details during investigations. Due to an improper setup of Jinja2 env… |
CVE-2024-4040 | Critical | 9.8 | 2024-04-22 | A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to… |
CVE-2023-47542 | Medium | 6.7 | 2024-04-09 | A improper neutralization of special elements used in a template engine [CWE-1336] in FortiManager versions 7.4.1 and below, versions 7.2.4 and below, and 7.0… |
CVE-2024-24724 | Critical | 9.8 | 2024-04-03 | Gibbon through 26.0.00 allows /modules/School%20Admin/messengerSettings.php Server Side Template Injection leading to Remote Code Execution because input is pa… |
CVE-2024-28116 | High | 8.8 | 2024-03-21 | Grav is an open-source, flat-file content management system. Grav CMS prior to version 1.7.45 is vulnerable to a Server-Side Template Injection (SSTI), which a… |
CVE-2024-27623 | Medium | 5.9 | 2024-03-05 | CMS Made Simple version 2.2.19 is vulnerable to Server-Side Template Injection (SSTI). The vulnerability exists within the Design Manager, particularly when ed… |
CVE-2023-5764 | High | 7.1 | 2023-12-12 | A template injection flaw was found in Ansible where a user's controller internal templating operations may remove the unsafe designation from template data. T… |
CVE-2023-6709 | High | 8.8 | 2023-12-12 | Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository mlflow/mlflow prior to 2.9.2. |
CVE-2023-46245 | High | 7.2 | 2023-10-31 | Kimai is a web-based multi-user time-tracking application. Versions prior to 2.1.0 are vulnerable to a Server-Side Template Injection (SSTI) which can be escal… |
CVE-2023-41047 | Medium | 6.2 | 2023-10-09 | OctoPrint is a web interface for 3D printers. OctoPrint versions up until and including 1.9.2 contain a vulnerability that allows malicious admins to configure… |
CVE-2023-29297 | Critical | 9.1 | 2023-06-15 | Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by a Improper Neutralization of Special Elements Us… |
CVE-2023-34448 | High | 8.8 | 2023-06-14 | Grav is a flat-file content management system. Prior to version 1.7.42, the patch for CVE-2022-2073, a server-side template injection vulnerability in Grav lev… |
CVE-2023-34253 | High | 8.8 | 2023-06-14 | Grav is a flat-file content management system. Prior to version 1.7.42, the denylist introduced in commit 9d6a2d to prevent dangerous functions from being exec… |
CVE-2023-34252 | High | 8.8 | 2023-06-14 | Grav is a flat-file content management system. Prior to version 1.7.42, there is a logic flaw in the `GravExtension.filterFilter()` function whereby validation… |
CVE-2023-2259 | High | 7.2 | 2023-04-24 | Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository alfio-event/alf.io prior to 2.0-M4-2304. |