CWE-791.

eosphoros-ai DB-GPT Jinja2 Template __init__.py FileBasedSkill.get_prompt special elements in template engine

• eosphoros-ai DB-GPT
• Code injection
• CWE-791

svg-sanitizer 0.5.0 before 1.1.0 Incomplete url() Filtering in SVG Attributes

• darylldoyle svg-sanitizer
• CWE-791

Furion .NET Framework View ViewEngine.cs RunCompile special elements in template engine

• Furion .NET Framework
• Code injection
• CWE-791

formtools.org Form Tools Client Settings Clients.class.php updateClientSettingsTab special elements in template engine

• formtools.org Form Tools
• Code injection
• CWE-791

Naichen ThinkCMF Email Template MailController.php templatePut special elements in template engine

• Naichen ThinkCMF
• Code injection
• CWE-791

Access control filter bypass allows unauthorised access to APIs

• N-able N-central
• CWE-791

Dromara UJCMS web-file-template Endpoint WebFileTemplateController.java update special elements in template engine

• Dromara UJCMS
• Code injection
• CWE-791

xianrendzw EasyReport SQL Preview Endpoint DesignerController.java previewSqlText special elements in template engine

• xianrendzw EasyReport
• Code injection
• CWE-791

OpenBoxes Template Processing DocumentController.groovy buildZebraTemplate special elements in template engine

• OpenBoxes
• Code injection
• CWE-791

langgenius dify Jinja2 jinja2_transformer.py jinja2.Template special elements used in a template engine

• langgenius dify
• Code injection
• CWE-791

Angular's deprecated package has a Cross-Site Scripting issue

• Cross-site scripting (XSS)
• CWE-791

>=1.2.0-rc.3, <=1.8.3 · no fixed version yet

Denial-of-Service via SVG Rendering in Ticket

• OTRS
• OTRS AG ((OTRS)) Community Edition
• Denial of service
• CWE-791

Dromara lamp-cloud Message Template GroovyClassLoader.parseClass special elements used in a template engine

• Dromara lamp-cloud
• Code injection
• CWE-791

Camel-CXF and Camel-Knative Message Header are Vulnerable to Injection via Missing Inbound Filtering

• CWE-178
• CWE-791

>=3.18.0, <4.14.6 || >=4.15.0, <4.18.2 · fixed in 4.14.6, 4.18.2

Sanluan PublicCMS templateResult API TemplateResultDirective.java execute special elements used in a template engine

• Sanluan PublicCMS
• Code injection
• CWE-791

dssrf: every IPv6 category bypasses is_url_safe

• CWE-791

<1.0.3 · fixed in 1.0.3

pf can overflow the stack parsing crafted SCTP packets

• FreeBSD
• Denial of service
• CWE-791

netfoil's optional seccomp sandboxing was not applied

• CWE-791

<0.2.1 · fixed in 0.2.1

AstrBot has Incomplete Filtering of Special Elements

• Code injection
• CWE-791

<=4.22.1 · no fixed version yet

Sanluan PublicCMS FreeMarker Template AbstractFreemarkerView.java AbstractFreemarkerView.doRender special elements used in a template engine

• Sanluan PublicCMS
• Code injection
• CWE-791

PyBlade: SSTI/RCE via Bypassed AST Validation in sandbox.py

• Code injection
• CWE-791

>=0.1.8-alpha, <=0.2.0-alpha · no fixed version yet

1024-lab/lab1024 SmartAdmin FreeMarker Template MailService.java freemarkerResolverContent special elements used in a template engine

• 1024-lab SmartAdmin
• lab1024 SmartAdmin
• Code injection
• CWE-791

OpenCart Incomplete Fix CVE-2024-36694 template.php save special elements used in a template engine

• OpenCart
• Code injection
• CWE-791

TechDocs Mkdocs Configuration Key Enables Arbitrary Code Execution

• Other injection
• Unrestricted file upload

<1.14.3 · fixed in 1.14.3

datapizza-ai: Server-Side Template Injection in ChatPromptTemplate via Jinja2 Template Handler

• Code injection
• CWE-791

<=0.0.2 · no fixed version yet

CTCMS Content Management System Frontend/Template Management CT_Parser.php special elements used in a template engine

• CTCMS Content Management System
• Code injection
• CWE-791

HAProxy Kubernetes Ingress Controller: HAProxy Kubernetes Ingress Controller before 3.1.13…

• HAProxy Kubernetes Ingress Controller
• CWE-791

ThingsBoard Add Gateway special elements used in a template engine

• ThingsBoard
• Code injection
• CWE-791

Kingdee Cloud-Starry-Sky Enterprise Edition Freemarker Engine DynamicForm 4 Action.class plugin.buildMobilePopHtml special elements used in a template engine

• Kingdee Cloud-Starry-Sky Enterprise Edition
• Code injection
• CWE-791

pyspur Incomplete Filtering of Special Elements allowed by SingleLLMCallNode function

• Code injection
• CWE-791

<=0.1.18 · no fixed version yet

AngularJS Incomplete Filtering of Special Elements vulnerability

• CWE-791

>=1.3.1, <=1.8.3 · no fixed version yet

The VAPIX Device Configuration framework allowed a privilege escalation, enabling a lower-privileged user to gain administrator privileges.

• Axis Communications AB AXIS OS
• CWE-791

zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 testService special elements used in a template engine

• zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台
• Code injection
• CWE-791

AngularJS improperly sanitizes SVG elements

• CWE-791

<=1.8.3 · no fixed version yet

wix-incubator jam Jinja2 Template jam.py special elements used in a template engine

• wix-incubator jam
• Code injection
• CWE-791

Improper authentication in SSH of B&R APROL

• B&R Industrial Automation B&R APROL
• CWE-791

zhijiantianya ruoyi-vue-pro deploy special elements used in a template engine

• zhijiantianya ruoyi-vue-pro
• Code injection
• CWE-791

Cross-Site Scripting (XSS) vulnerability in SAP Web Dispatcher

• SAP_SE SAP Web Dispatcher
• CWE-791

AngularJS allows attackers to bypass common image source restrictions

• CWE-791

<=1.8.3 · no fixed version yet

Intel(R) TDX module software: Incomplete filtering of special elements in Intel(R) TDX module software before version…

• Intel(R) TDX module software
• CWE-791

An issue in the DelFile() function of WMCMS v4.4 allows attackers to delete arbitrary files via a crafted POST request.

• CWE-473
• CWE-791

PrivateBin allows shortening of URLs for other domains

• CWE-305
• CWE-791

>=1.5.0, <1.7.4 · fixed in 1.7.4

CMSeasy 7.7.7.9 is vulnerable to Arbitrary file deletion.

• CWE-791

The XAO::Web module before 1.84 for Perl mishandles < and > characters in JSON output during use of json-embed in Web::Action.

• CWE-791

Incomplete Filtering of Special Elements

• Schweitzer Engineering Laboratories SEL-5030 acSELerator QuickSet Software
• CWE-791

A flaw was found in the Linux Kernel.

• Linux kernel
• CWE-791

A permissive list of allowed inputs flaw was found in DPDK.

• dpdk
• CWE-791

Pipenv's requirements.txt parsing allows malicious index url in comments

• Command injection
• CWE-20

>=2018.10.9, <2022.1.8 · fixed in 2022.1.8