CWE-1336 · Command and Code Injection
Improper Neutralization of Special Elements Used in a Template Engine
279CVEs
3exploited
7with a public check
6likely (EPSS 10%+)
SortMost likely exploited
279 CVEs with CWE-1336 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2024-4040In CISA KEVExploitedCrushFTP VFS - Sandbox Escape LFRCrushFTP · CrushFTP · CVSS 9.8 · 2024-04-22 | 9.8 | 100% | 2024-04-22 |
| CVE-2024-23692In CISA KEVExploitedRejetto HTTP File Server - Template injectionRejetto · HTTP File Server · CVSS 9.8 · 2024-05-31 | 9.8 | 99% | 2024-05-31 |
| CVE-2026-75650In CISA KEVExploitedAdobe Commerce/Magento <= 2.4.9 - StyleSmuggler Unauthenticated RCE via SSTIAdobe · Adobe Commerce · CVSS 10 · 2026-09-07 | 10.0 | 99% | 2026-09-07 |
| CVE-2024-32651CheckChange Detection - Server Side Template Injectiondgtlmoon · changedetection.io · CVSS 10 · 2024-04-25 | 10.0 | 85% | 2024-04-25 |
| CVE-2025-47916CheckInvision Community <=5.0.6 Unauthenticated RCE via Template Injectioninvisioncommunity · Invision Power Board · CVSS 10 · 2025-05-16 | 10.0 | 84% | 2025-05-16 |
| CVE-2025-34300CheckSawtoothSoftware Lighthouse Studio < 9.16.14 - Pre-Auth Remote Code ExecutionSawtooth Software · Lighthouse Studio · CVSS 10 · 2025-07-16 | 10.0 | 81% | 2025-07-16 |
| CVE-2025-53833CheckLaRecipe < 2.8.1 Remote Code Execution via SSTIsaleem-hadad · larecipe · CVSS 10 · 2025-07-14 | 10.0 | 9.1% | 2025-07-14 |
| CVE-2026-97359CheckRejetto HTTP File Server 2.4.x - Template Injectionrejetto · hfs2 · CVSS 10 · 2026-09-24 | 10.0 | 5.5% | 2026-09-24 |
| CVE-2025-23211CheckTandoor Recipes < 1.5.24 - Jinja2 SSTI RCETandoorRecipes · recipes · CVSS 10 · 2025-01-28 | 10.0 | 3.7% | 2025-01-28 |
| CVE-2026-28496CheckFOSSBilling - Server-Side Template InjectionFOSSBilling · FOSSBilling · CVSS 9.4 · 2026-06-23 | 9.4 | 1.9% | 2026-06-23 |
| CVE-2022-25813Server-Side Template Injection affecting the ecommerce plugin of Apache OFBizApache Software Foundation · Apache OFBiz · 2022-09-02 | – | 67% | 2022-09-02 |
| CVE-2024-24724Gibbon through 26.0.00 allows /modules/School%20Admin/messengerSettings.php Server Side Template Injection leading to Remote Code Execution because input is passed to the Twig tem…Gibbonedu · Gibbon · CVSS 9.8 · 2024-04-03 | 9.8 | 26% | 2024-04-03 |
| CVE-2024-6386WPML Multilingual CMS <= 4.6.12 - Authenticated (Contributor+) Remote Code Execution via Twig Server-Side Template InjectionWPML · WPML · CVSS 9.9 · 2024-08-21 | 9.9 | 26% | 2024-08-21 |
| CVE-2025-49619Skyvern through 0.1.85 is vulnerable to server-side template injection (SSTI) in the Prompt field of workflow blocks such as the Navigation v2 Block. Improper sanitization of Jinj…Skyvern · Skyvern · CVSS 8.5 · 2025-06-07 | 8.5 | 22% | 2025-06-07 |
| CVE-2026-90970Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI GatewayGitLab · GitLab AI Gateway · CVSS 9.9 · 2026-10-02 | 9.9 | 17% | 2026-10-02 |
| CVE-2026-26026GLPI has a Server-Side Template Injection via Double-Compilationglpi-project · glpi · CVSS 9.1 · 2026-04-06 | 9.1 | 12% | 2026-04-06 |
| CVE-2022-0944Template injection in connection test endpoint leads to RCE in sqlpad/sqlpadsqlpad · sqlpad/sqlpad · CVSS 9.1 · 2022-03-15 | 9.1 | 8.5% | 2022-03-15 |
| CVE-2025-14700Improper Neutralization of Special Elements Used in a Template Engine in Crafty ControllerArcadia Technology, LLC · Crafty Controller · CVSS 9.9 · 2025-12-17 | 9.9 | 6.6% | 2025-12-17 |
| CVE-2024-28116Server-Side Template Injection (SSTI) with Grav CMS security sandbox bypassgetgrav · grav · CVSS 8.8 · 2024-03-21 | 8.8 | 5.8% | 2024-03-21 |
| CVE-2023-34448Grav Server-side Template Injection (SSTI) via Twig Default Filtersgetgrav · grav · CVSS 8.8 · 2023-06-14 | 8.8 | 4.5% | 2023-06-14 |
| CVE-2025-66294Grav is vulnerable to RCE via SSTI through Twig Sandbox Bypassgetgrav · grav · CVSS 8.7 · 2025-12-01 | 8.7 | 3.0% | 2025-12-01 |
| CVE-2021-39128Affected versions of Atlassian Jira Server or Data Center using the Jira Service Management addon allow remote attackers with JIRA Administrators access to execute arbitrary Java…Atlassian · Jira Server · CVSS 7.2 · 2021-09-16 | 7.2 | 2.6% | 2021-09-16 |
| CVE-2025-69516A Server-Side Template Injection (SSTI) vulnerability in the /reporting/templates/preview/ endpoint of Amidaware Tactical RMM, affecting versions equal to or earlier than v1.3.1,…Amidaware · Tactical Rmm · CVSS 8.8 · 2026-01-29 | 8.8 | 2.3% | 2026-01-29 |
| CVE-2025-49828Conjur OSS and Secrets Manager, Self-Hosted (formerly Conjur Enterprise) Vulnerable to Remote Code Executioncyberark · conjur · CVSS 8.6 · 2025-07-15 | 8.6 | 2.2% | 2025-07-15 |
| CVE-2025-59340jinjava Sandbox Bypass via JavaType-Based DeserializationHubSpot · jinjava · CVSS 9.8 · 2025-09-17 | 9.8 | 2.2% | 2025-09-17 |
| CVE-2023-46245Kimai (Authenticated) SSTI to RCE by Uploading a Malicious Twig Filekimai · kimai · CVSS 7.2 · 2023-10-31 | 7.2 | 1.8% | 2023-10-31 |
| CVE-2026-73299Prompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Renderermicrosoft · prompty · CVSS 10 · 2026-08-12 | 10.0 | 1.8% | 2026-08-12 |
| CVE-2025-1040Server-Side Template Injection (SSTI) in significant-gravitas/autogptsignificant-gravitas · significant-gravitas/autogpt · CVSS 8.8 · 2025-03-20 | 8.8 | 1.7% | 2025-03-20 |
| CVE-2025-49136listmonk's Sprig template Injection vulnerability leads to reading of Environment Variable for low privilege userknadh · listmonk · CVSS 9.1 · 2025-06-09 | 9.1 | 1.6% | 2025-06-09 |
| CVE-2025-46731Craft CMS Contains a Potential Remote Code Execution Vulnerability via Twig SSTIcraftcms · cms · CVSS 7.3 · 2025-05-05 | 7.3 | 1.5% | 2025-05-05 |
| CVE-2026-12370Remote Code Execution VulnerabilityZohocorp · ManageEngine OpManager · CVSS 7.6 · 2026-09-23 | 7.6 | 1.5% | 2026-09-23 |
| CVE-2022-0896Improper Neutralization of Special Elements Used in a Template Engine in microweber/microwebermicroweber · microweber/microweber · CVSS 7.1 · 2022-03-09 | 7.1 | 1.4% | 2022-03-09 |
| CVE-2024-12583Dynamics 365 Integration <= 1.3.23 - Authenticated (Contributor+) Remote Code Execution and Arbitrary File Read via Twig Server-Side Template Injectionalexacrm · Dynamics 365 Integration · CVSS 9.9 · 2025-01-04 | 9.9 | 1.4% | 2025-01-04 |
| CVE-2026-39980OpenCTI affected by RCE via notifier templateOpenCTI-Platform · opencti · CVSS 9.1 · 2026-04-09 | 9.1 | 1.4% | 2026-04-09 |
| CVE-2026-48323Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)Adobe · Adobe Campaign Classic · CVSS 10 · 2026-08-03 | 10.0 | 1.4% | 2026-08-03 |
| CVE-2026-21450Bagisto has SSTI in parameter that can lead to RCEbagisto · bagisto · CVSS 7.3 · 2026-01-02 | 7.3 | 1.4% | 2026-01-02 |
| CVE-2023-29297Admin-to-admin stored XSS via cache poisoningAdobe · Magento Commerce · CVSS 9.1 · 2023-06-15 | 9.1 | 1.4% | 2023-06-15 |
| CVE-2024-45053Remote Code Execution Vulnerability via SSTI in Fides Webserver Jinja Email Templating Engineethyca · fides · CVSS 9.1 · 2024-09-04 | 9.1 | 1.3% | 2024-09-04 |
| CVE-2026-27641Flask-Reuploaded vulnerable to Remote Code Execution via Server-Side Template Injectionjugmac00 · flask-reuploaded · CVSS 9.8 · 2026-02-25 | 9.8 | 1.3% | 2026-02-25 |
| CVE-2026-22244OpenMetadata Server-Side Template Injection (SSTI) in FreeMarker email templates that leads to RCEopen-metadata · OpenMetadata · CVSS 8.5 · 2026-01-08 | 8.5 | 1.3% | 2026-01-08 |
| CVE-2026-52889Formie: Server-Side Template Injection in Formie Hidden field defaultsverbb · formie · CVSS 9.8 · 2026-08-19 | 9.8 | 1.3% | 2026-08-19 |
| CVE-2023-6743Unlimited Elements for Elementor <= 1.5.89 - Authenticated(Contributor+) Remote Code Execution via template importunitecms · Unlimited Elements For Elementor · CVSS 8.8 · 2024-05-29 | 8.8 | 1.3% | 2024-05-29 |
| CVE-2026-102142Kiteworks Core Remote Code Execution through Server-Side Template InjectionKiteworks · Core · CVSS 7.2 · 2026-09-30 | 7.2 | 1.2% | 2026-09-30 |
| CVE-2026-28697Craft Affected by Authenticated RCE via "craft.app.fs.write()" in Twig Templatescraftcms · cms · CVSS 9.4 · 2026-03-04 | 9.4 | 1.2% | 2026-03-04 |
| CVE-2026-88064Backstage: Improper input validation in TechDocs MkDocs configurationbackstage · backstage · CVSS 8.8 · 2026-09-16 | 8.8 | 1.2% | 2026-09-16 |
| CVE-2024-41950Insecure Jinja2 templates rendered in Haystack Components can lead to RCEdeepset-ai · haystack · CVSS 7.5 · 2024-07-31 | 7.5 | 1.2% | 2024-07-31 |
| CVE-2026-103849Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)Adobe · Adobe Commerce · CVSS 10 · 2026-10-13 | 10.0 | 1.2% | 2026-10-13 |
| CVE-2024-30372Allegra getLinkText Server-Side Template Injection Remote Code Execution VulnerabilityAllegra · Allegra · CVSS 8.8 · 2024-11-22 | 8.8 | 1.2% | 2024-11-22 |
| CVE-2023-27995A improper neutralization of special elements used in a template engine vulnerability in Fortinet FortiSOAR 7.3.0 through 7.3.1 allows an authenticated, remote attacker to execute…Fortinet · FortiSOAR · CVSS 7.2 · 2023-04-11 | 7.2 | 1.1% | 2023-04-11 |
| CVE-2024-7129Appointment Booking Calendar < 1.6.7.43 - Admin+ Template Injection to RCENsqua · Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin · CVSS 7.2 · 2024-09-13 | 7.2 | 1.1% | 2024-09-13 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.