Weaknesses of type CWE-1336

302 results

Divulgação de Informações

É quando a aplicação expõe dados sensíveis (senhas, tokens, chaves, dados pessoais, caminhos internos) para quem não deveria acessá-los. Pode acontecer por erro de configuração, logs verbosos, mensagens de erro detalhadas, ou armazenamento inadequado. O risco é que um atacante consiga informações que facilitem outros ataques.

Example

Um servidor Node.js em produção deixando debug mode ativo, que retorna stack traces completos nas respostas de erro (incluindo caminhos absolutos e variáveis de ambiente), ou um endpoint de recuperação de senha que retorna 'email encontrado' vs 'email não encontrado', revelando quais usuários existem no sistema.

How to mitigate

Desabilite modo debug/verbose em produção; sanitize mensagens de erro para consumidor final (log detalhes internamente, não exponha ao usuário); remova metadados sensíveis de respostas HTTP; aplique princípio do menor privilégio em configurações de acesso a arquivos; nunca exporte credenciais ou chaves em logs ou comentários de código.

CVE-2026-71880HIGHServer-side template injection in Integrated Publishing ToolkitEPSS 0.5%CVE-2026-54664HIGHswagger-typescript-api vulnerable to code injection via unescaped enum string valuesEPSS 0.5%CVE-2026-54661HIGHswagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in axios http-client templateEPSS 0.5%CVE-2026-104851HIGHfsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code ExecutionEPSS 0.5%CVE-2026-45697CRITICALFormie: Pre-authenticated server-side template injection in Hidden fieldsEPSS 0.5%CVE-2026-92982HIGHAnsible-operator-plugins: ansible operator plugins: arbitrary code execution via jinja2 template injectionEPSS 0.5%CVE-2026-107248HIGHCVE-2026-107248EPSS 0.5%CVE-2026-44723MEDIUMVowpal Wabbit: Shell injection via crafted PR title in python_checks.yml allows arbitrary command execution on CI runnerEPSS 0.5%CVE-2026-108264CRITICALWizarr: Authenticated Server-Side Template Injection (SSTI) in wizard step rendering leads to Remote Code Execution (RCE)EPSS 0.5%CVE-2025-10380HIGHAdvanced Views – Display Posts, Custom Fields, and More <= 3.7.19 - Authenticated (Author+) Remote Code Execution via SSTIEPSS 0.5%CVE-2026-23626MEDIUMKimai Vulnerable to Authenticated Server-Side Template Injection (SSTI)EPSS 0.5%CVE-2026-3725MEDIUM1024-lab/lab1024 SmartAdmin FreeMarker Template MailService.java freemarkerResolverContent special elements used in a template engineEPSS 0.5%CVE-2025-3841MEDIUMwix-incubator jam Jinja2 Template jam.py special elements used in a template engineEPSS 0.5%CVE-2025-14731MEDIUMCTCMS Content Management System Frontend/Template Management CT_Parser.php special elements used in a template engineEPSS 0.4%CVE-2024-54954HIGHOneBlog v2.3.6 was discovered to contain a template injection vulnerability via the template management department.EPSS 0.4%CVE-2026-45312CRITICALRAGFlow: Server-Side Template Injection in Prompt Generator leads to Remote Code ExecutionEPSS 0.4%CVE-2026-47752CRITICALTugtainer has Server-Side Template Injection in notification templates that leads to Remote Code ExecutionEPSS 0.4%CVE-2026-110593MEDIUMBottleCRM through 1.14.5 Server-Side Template Injection via Account Email create_mailEPSS 0.4%CVE-2025-35113MEDIUMAgiloft improper neutralization in EUI template engineEPSS 0.4%CVE-2024-27623MEDIUMCMS Made Simple version 2.2.19 is vulnerable to Server-Side Template Injection (SSTI). The vulnerability exists within the Design Manager, pEPSS 0.4%