Weaknesses of type CWE-1336

257 results

Divulgação de Informações

É quando a aplicação expõe dados sensíveis (senhas, tokens, chaves, dados pessoais, caminhos internos) para quem não deveria acessá-los. Pode acontecer por erro de configuração, logs verbosos, mensagens de erro detalhadas, ou armazenamento inadequado. O risco é que um atacante consiga informações que facilitem outros ataques.

Example

Um servidor Node.js em produção deixando debug mode ativo, que retorna stack traces completos nas respostas de erro (incluindo caminhos absolutos e variáveis de ambiente), ou um endpoint de recuperação de senha que retorna 'email encontrado' vs 'email não encontrado', revelando quais usuários existem no sistema.

How to mitigate

Desabilite modo debug/verbose em produção; sanitize mensagens de erro para consumidor final (log detalhes internamente, não exponha ao usuário); remova metadados sensíveis de respostas HTTP; aplique princípio do menor privilégio em configurações de acesso a arquivos; nunca exporte credenciais ou chaves em logs ou comentários de código.

CVE-2026-33130MEDIUMUptime Kuma: SSTI in Notification Templates Allows Arbitrary File Read (Incomplete Fix for GHSA-vffh-c9pq-4crh)EPSS 0.5%CVE-2026-34724HIGHZammad has a server-side template injection leading to RCE via AI AgentEPSS 0.5%CVE-2026-3714MEDIUMOpenCart Incomplete Fix CVE-2024-36694 template.php save special elements used in a template engineEPSS 0.5%CVE-2025-60355CRITICALzhangyd-c OneBlog v2.3.9 and before was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates.EPSS 0.5%CVE-2026-40087MEDIUMLangChain has incomplete f-string validation in prompt templatesEPSS 0.5%CVE-2026-23626MEDIUMKimai Vulnerable to Authenticated Server-Side Template Injection (SSTI)EPSS 0.5%CVE-2025-14731MEDIUMCTCMS Content Management System Frontend/Template Management CT_Parser.php special elements used in a template engineEPSS 0.4%CVE-2024-54954HIGHOneBlog v2.3.6 was discovered to contain a template injection vulnerability via the template management department.EPSS 0.4%CVE-2025-3841MEDIUMwix-incubator jam Jinja2 Template jam.py special elements used in a template engineEPSS 0.4%CVE-2026-32261HIGHRCE via SSTI for users with permissions to access the Craft CMS Webhooks pluginEPSS 0.4%CVE-2025-10380HIGHAdvanced Views – Display Posts, Custom Fields, and More <= 3.7.19 - Authenticated (Author+) Remote Code Execution via SSTIEPSS 0.4%CVE-2024-27623MEDIUMCMS Made Simple version 2.2.19 is vulnerable to Server-Side Template Injection (SSTI). The vulnerability exists within the Design Manager, pEPSS 0.4%CVE-2025-35113MEDIUMAgiloft improper neutralization in EUI template engineEPSS 0.4%CVE-2026-5336MEDIUMDataverse Integration < 2.91 - Contributor+ Server-Side Template Injection (SSTI) to Information DisclosureEPSS 0.4%CVE-2026-73858MEDIUMSolspace Freeform: Limited Twig template injection via submitted field valuesEPSS 0.4%CVE-2026-26938HIGHImproper Neutralization of Special Elements Used in a Template Engine in Kibana Workflows Leading to Server-Side Request Forgery (SSRF)EPSS 0.4%CVE-2026-81910MEDIUMConcrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection (SSTI) in Theme Customizer via Unvalidated Style ValuesEPSS 0.4%CVE-2026-5559MEDIUMAntaresMugisho PyBlade AST Validation sandbox.py _is_safe_ast special elements used in a template engineEPSS 0.4%CVE-2026-75979MEDIUMxianrendzw EasyReport SQL Preview Endpoint DesignerController.java previewSqlText special elements in template engineEPSS 0.4%CVE-2026-6984MEDIUMAstrBotDevs AstrBot Dashboard API t2i.py create_template special elements used in a template engineEPSS 0.4%