Monthly
Arbitrary JavaScript execution in AngularJS (all versions from 1.2.0-rc.3 onward) arises from a flaw in Strict Contextual Escaping (SCE) where resource-URL allowlist regular expressions are matched against URLs as partial rather than whole-string matches, letting attacker-controlled values slip past trusted-URL policies. A successful bypass runs script in the victim's browser session (script src, iframe documents, route templates), enabling client-side compromise; the framework is End-of-Life with no upstream fix, and a CodePen demonstration of the bypass is publicly available. No CISA KEV listing and no evidence of active exploitation were provided.
The dssrf Node.js library (versions < 1.3.0) allows Server-Side Request Forgery (SSRF) protection bypass through IPv6 addresses targeting internal resources. Attackers can craft HTTP requests using IPv6 loopback (::1), unique local addresses (fc00::/7), link-local addresses (fe80::/10), IPv4-mapped IPv6 addresses (::ffff:127.0.0.1, ::ffff:169.254.169.254), NAT64 prefixes, and other IPv6 categories to access internal services, cloud metadata endpoints (IMDS), and private networks that the library was explicitly designed to block. The vulnerability directly contradicts dssrf documentation claiming IPv6 is disabled entirely, and a publicly available exploit code (POC) demonstrates all affected IPv6 categories. Patch available in version 1.3.0.
Unauthenticated remote access to restricted internal APIs is possible in N-able N-central due to an incomplete access control filter, classified under CWE-791. All N-central deployments prior to versions 2026.3 HF3 and 2026.4 are affected, as confirmed by the vendor advisory. Impact is limited to partial information disclosure (CVSS 4.0 VC:L) with no integrity or availability effects reported; no public exploit code or active exploitation has been identified at time of analysis.
Server-side template injection in OpenBoxes up to v0.9.6 allows authenticated low-privilege users to execute arbitrary Groovy code via the Zebra label template rendering endpoint. The root cause is that the original TemplateService passed user-controlled template content to GroovyPagesTemplateEngine, which evaluates ${...} placeholders as full Groovy expressions — enabling OS command execution and classloader traversal analogous to Spring4Shell. A public proof-of-concept is referenced in the NVD advisory; no active exploitation is confirmed in CISA KEV. The provided CVSS 4.0 score of 2.1 materially underestimates real-world risk for this vulnerability class.
Improper neutralization of special elements in FreeMarker template processing within Sanluan PublicCMS up to version 6.202506.d allows high-privileged remote attackers to cause information disclosure through manipulation of the AbstractFreemarkerView.doRender function. The vulnerability has a CVSS score of 5.1 with publicly available exploit code, though exploitation requires administrative privileges (PR:H). CISA KEV status not confirmed; however, the disclosure of exploit code and vendor non-response indicate moderate real-world risk despite the high privilege requirement.
SmartAdmin versions up to 3.29 contain a template injection vulnerability in the FreeMarker template handler that allows authenticated remote attackers to manipulate template content and achieve code execution. The flaw exists in the MailService component's freemarkerResolverContent function and has a public exploit available. Since no patch is available and the vendor has not responded, organizations using affected versions should immediately assess exposure and consider alternative solutions.
OpenCart 4.0.2.3 contains an incomplete fix for a template injection vulnerability in the admin template controller that allows high-privileged attackers to inject malicious code through improper neutralization of special template elements. An authenticated administrator can exploit this flaw to achieve arbitrary code execution on the affected system. No patch is currently available, and the vendor has not responded to disclosure attempts.
Improper input sanitization in Datapizza AI 0.0.2's Jinja2 template handler allows remote attackers with high privileges to inject malicious template syntax through the ChatPromptTemplate function, potentially enabling code execution or information disclosure. Public exploit code exists for this vulnerability, and no patch is currently available from the vendor despite early notification.
Template injection in CTCMS up to version 2.1.2 allows authenticated remote attackers to bypass template engine protections via improper neutralization of special elements in the Frontend/Template Management Module. The vulnerability affects the CT_Parser.php library and enables information disclosure with low confidentiality, integrity, and availability impact. Publicly available exploit code exists, though EPSS exploitation probability remains low at 0.09% (26th percentile), suggesting limited real-world weaponization despite POC availability.
Information disclosure in HAProxy Kubernetes Ingress Controller before 3.1.13 allows an authenticated attacker with Kubernetes RBAC create/update permissions on Ingress resources to obtain an ingress token secret when the non-default config-snippets feature flag is enabled. Exploitation requires two specific preconditions: the config-snippets feature flag must be active, and the attacker must already possess create/update permissions on Ingress objects. No public exploit code has been identified, and the EPSS score is 0.26% (16th percentile), indicating low likelihood of exploitation. The issue is fixed in version 3.1.13 for the open-source controller and in enterprise versions 3.0.16-ee1, 1.11.13-ee1, and 1.9.15-ee1.
Arbitrary JavaScript execution in AngularJS (all versions from 1.2.0-rc.3 onward) arises from a flaw in Strict Contextual Escaping (SCE) where resource-URL allowlist regular expressions are matched against URLs as partial rather than whole-string matches, letting attacker-controlled values slip past trusted-URL policies. A successful bypass runs script in the victim's browser session (script src, iframe documents, route templates), enabling client-side compromise; the framework is End-of-Life with no upstream fix, and a CodePen demonstration of the bypass is publicly available. No CISA KEV listing and no evidence of active exploitation were provided.
The dssrf Node.js library (versions < 1.3.0) allows Server-Side Request Forgery (SSRF) protection bypass through IPv6 addresses targeting internal resources. Attackers can craft HTTP requests using IPv6 loopback (::1), unique local addresses (fc00::/7), link-local addresses (fe80::/10), IPv4-mapped IPv6 addresses (::ffff:127.0.0.1, ::ffff:169.254.169.254), NAT64 prefixes, and other IPv6 categories to access internal services, cloud metadata endpoints (IMDS), and private networks that the library was explicitly designed to block. The vulnerability directly contradicts dssrf documentation claiming IPv6 is disabled entirely, and a publicly available exploit code (POC) demonstrates all affected IPv6 categories. Patch available in version 1.3.0.
Unauthenticated remote access to restricted internal APIs is possible in N-able N-central due to an incomplete access control filter, classified under CWE-791. All N-central deployments prior to versions 2026.3 HF3 and 2026.4 are affected, as confirmed by the vendor advisory. Impact is limited to partial information disclosure (CVSS 4.0 VC:L) with no integrity or availability effects reported; no public exploit code or active exploitation has been identified at time of analysis.
Server-side template injection in OpenBoxes up to v0.9.6 allows authenticated low-privilege users to execute arbitrary Groovy code via the Zebra label template rendering endpoint. The root cause is that the original TemplateService passed user-controlled template content to GroovyPagesTemplateEngine, which evaluates ${...} placeholders as full Groovy expressions — enabling OS command execution and classloader traversal analogous to Spring4Shell. A public proof-of-concept is referenced in the NVD advisory; no active exploitation is confirmed in CISA KEV. The provided CVSS 4.0 score of 2.1 materially underestimates real-world risk for this vulnerability class.
Improper neutralization of special elements in FreeMarker template processing within Sanluan PublicCMS up to version 6.202506.d allows high-privileged remote attackers to cause information disclosure through manipulation of the AbstractFreemarkerView.doRender function. The vulnerability has a CVSS score of 5.1 with publicly available exploit code, though exploitation requires administrative privileges (PR:H). CISA KEV status not confirmed; however, the disclosure of exploit code and vendor non-response indicate moderate real-world risk despite the high privilege requirement.
SmartAdmin versions up to 3.29 contain a template injection vulnerability in the FreeMarker template handler that allows authenticated remote attackers to manipulate template content and achieve code execution. The flaw exists in the MailService component's freemarkerResolverContent function and has a public exploit available. Since no patch is available and the vendor has not responded, organizations using affected versions should immediately assess exposure and consider alternative solutions.
OpenCart 4.0.2.3 contains an incomplete fix for a template injection vulnerability in the admin template controller that allows high-privileged attackers to inject malicious code through improper neutralization of special template elements. An authenticated administrator can exploit this flaw to achieve arbitrary code execution on the affected system. No patch is currently available, and the vendor has not responded to disclosure attempts.
Improper input sanitization in Datapizza AI 0.0.2's Jinja2 template handler allows remote attackers with high privileges to inject malicious template syntax through the ChatPromptTemplate function, potentially enabling code execution or information disclosure. Public exploit code exists for this vulnerability, and no patch is currently available from the vendor despite early notification.
Template injection in CTCMS up to version 2.1.2 allows authenticated remote attackers to bypass template engine protections via improper neutralization of special elements in the Frontend/Template Management Module. The vulnerability affects the CT_Parser.php library and enables information disclosure with low confidentiality, integrity, and availability impact. Publicly available exploit code exists, though EPSS exploitation probability remains low at 0.09% (26th percentile), suggesting limited real-world weaponization despite POC availability.
Information disclosure in HAProxy Kubernetes Ingress Controller before 3.1.13 allows an authenticated attacker with Kubernetes RBAC create/update permissions on Ingress resources to obtain an ingress token secret when the non-default config-snippets feature flag is enabled. Exploitation requires two specific preconditions: the config-snippets feature flag must be active, and the attacker must already possess create/update permissions on Ingress objects. No public exploit code has been identified, and the EPSS score is 0.26% (16th percentile), indicating low likelihood of exploitation. The issue is fixed in version 3.1.13 for the open-source controller and in enterprise versions 3.0.16-ee1, 1.11.13-ee1, and 1.9.15-ee1.