Falhas do tipo CWE-1336

301 resultados

Divulgação de Informações

A aplicação expõe dados sensíveis (credenciais, tokens, arquivos internos, estrutura do sistema) a usuários ou atacantes que não deveriam acessá-los. Isso ocorre por falta de controle de acesso adequado, validação insuficiente ou exposição acidental de dados em logs, mensagens de erro ou respostas HTTP.

Exemplo

Um site exibe mensagens de erro detalhadas que revelam caminhos de arquivos e versões de banco de dados; ou uma API retorna dados de outros usuários porque não valida permissões; ou credenciais ficam expostas em comentários do código-fonte publicado.

Como mitigar

Implemente controle de acesso granular (verificar quem acessa o quê); sanitize mensagens de erro (mostrar genéricas ao usuário, logs detalhados apenas internamente); revise e restrinja dados retornados por APIs; escaneie repositórios e logs de produção para credenciais expostas.

CVE-2024-45053CRITICALRemote Code Execution Vulnerability via SSTI in Fides Webserver Jinja Email Templating EngineEPSS 1.3%CVE-2026-27641CRITICALFlask-Reuploaded vulnerable to Remote Code Execution via Server-Side Template InjectionEPSS 1.3%CVE-2026-22244HIGHOpenMetadata Server-Side Template Injection (SSTI) in FreeMarker email templates that leads to RCEEPSS 1.3%CVE-2026-52889CRITICALFormie: Server-Side Template Injection in Formie Hidden field defaultsEPSS 1.3%CVE-2023-6743HIGHUnlimited Elements for Elementor <= 1.5.89 - Authenticated(Contributor+) Remote Code Execution via template importEPSS 1.3%CVE-2026-102142HIGHKiteworks Core Remote Code Execution through Server-Side Template InjectionEPSS 1.2%CVE-2026-28697CRITICALCraft Affected by Authenticated RCE via "craft.app.fs.write()" in Twig TemplatesEPSS 1.2%CVE-2026-88064HIGHBackstage: Improper input validation in TechDocs MkDocs configurationEPSS 1.2%CVE-2024-41950HIGHInsecure Jinja2 templates rendered in Haystack Components can lead to RCEEPSS 1.2%CVE-2026-103849CRITICALAdobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)EPSS 1.2%CVE-2024-30372HIGHAllegra getLinkText Server-Side Template Injection Remote Code Execution VulnerabilityEPSS 1.2%CVE-2023-27995HIGHA improper neutralization of special elements used in a template engine vulnerability in Fortinet FortiSOAR 7.3.0 through 7.3.1 allows an auEPSS 1.1%CVE-2025-67843HIGHA Server-Side Template Injection (SSTI) vulnerability in the MDX Rendering Engine in Mintlify Platform before 2025-11-15 allows remote attacEPSS 1.1%CVE-2024-32406HIGHServer-Side Template Injection (SSTI) vulnerability in inducer relate before v.2024.1 allows a remote attacker to execute arbitrary code viaEPSS 1.1%CVE-2026-40478CRITICALImproper neutralization of specific syntax patterns for unauthorized expressions in ThymeleafEPSS 1.1%CVE-2023-2259CRITICALImproper Neutralization of Special Elements Used in a Template Engine in alfio-event/alf.ioEPSS 1.1%CVE-2026-54718HIGHSilverstripe Advanced Workflow: Remote code execution via advanced workflow email templateEPSS 1.0%CVE-2024-37301HIGHdocument-merge-service vulnerable to Remote Code Execution via Server-Side Template InjectionEPSS 1.0%CVE-2026-65974CRITICALERPNext: Server-Side Template Injection leading to Remote Code ExecutionEPSS 1.0%CVE-2026-44266CRITICALElo: Remote Code Execution in Elo Ruby backend via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labelsEPSS 1.0%