Falhas do tipo CWE-1336

254 resultados

Divulgação de Informações

A aplicação expõe dados sensíveis (credenciais, tokens, arquivos internos, estrutura do sistema) a usuários ou atacantes que não deveriam acessá-los. Isso ocorre por falta de controle de acesso adequado, validação insuficiente ou exposição acidental de dados em logs, mensagens de erro ou respostas HTTP.

Exemplo

Um site exibe mensagens de erro detalhadas que revelam caminhos de arquivos e versões de banco de dados; ou uma API retorna dados de outros usuários porque não valida permissões; ou credenciais ficam expostas em comentários do código-fonte publicado.

Como mitigar

Implemente controle de acesso granular (verificar quem acessa o quê); sanitize mensagens de erro (mostrar genéricas ao usuário, logs detalhados apenas internamente); revise e restrinja dados retornados por APIs; escaneie repositórios e logs de produção para credenciais expostas.

CVE-2024-42356HIGHShopware vulnerable to Server Side Template Injection in Twig using Context functionsEPSS 0.6%CVE-2026-88064HIGHBackstage: Improper input validation in TechDocs MkDocs configurationEPSS 0.6%CVE-2026-72827HIGHGrav CMS before 2.0.13 Remote Code Execution via TwigEPSS 0.6%CVE-2026-62682CRITICALOrval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)EPSS 0.6%CVE-2026-11407HIGHPimcore CMS 12.3.8 Twig Sandbox Bypass via SecurityPolicy checkMethodAllowedEPSS 0.6%CVE-2024-55660MEDIUMSiYuan has an SSTI via /api/template/renderSprigEPSS 0.6%CVE-2026-44845MEDIUMJumpServer: Remote Command Execution (RCE) via Jinja Template Injection in Applet Host DeploymentEPSS 0.6%CVE-2026-34172HIGHGiskard Agents have Server-side template injection via ChatWorkflow.chat() using non-sandboxed Jinja2 EnvironmentEPSS 0.6%CVE-2025-52122CRITICALFreeform 5.0.0 to before 5.10.16, a plugin for CraftCMS, contains an Server-side template injection (SSTI) vulnerability, resulting in arbitEPSS 0.6%CVE-2024-48962HIGHApache OFBiz: Bypass SameSite restrictions with target redirection using URL parameters (SSTI and CSRF leading to RCE)EPSS 0.6%CVE-2026-71868CRITICALOrval: Import-time RCE via enum-typed default -> zod module-level template literalEPSS 0.6%CVE-2026-71869CRITICALOrval: Import-time RCE via array-items default -> zod module-level template literalEPSS 0.6%CVE-2026-54390CRITICALJTL Shop < 5.7.2 Server-Side Template Injection via Smarty RendererEPSS 0.6%CVE-2025-66299HIGHSecurity Sandbox Bypass with SSTI (Server Side Template Injection) in the Grav CMSEPSS 0.6%CVE-2025-66437HIGHAn SSTI (Server-Side Template Injection) vulnerability exists in the get_address_display method of Frappe ERPNext through 15.89.0. This funcEPSS 0.6%CVE-2025-66434HIGHAn SSTI (Server-Side Template Injection) vulnerability exists in the get_dunning_letter_text method of Frappe ERPNext through 15.89.0. The fEPSS 0.6%CVE-2026-73330HIGHCamaleonCMS 2.9.1 Server-Side Template Injection via test_email ActionEPSS 0.6%CVE-2026-28797HIGHRAGFlow: Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE) in Agent "Text Processing" ComponentEPSS 0.6%CVE-2025-64087CRITICALA Server-Side Template Injection (SSTI) vulnerability in the FreeMarker component of opensagres XDocReport v1.0.0 to v2.1.0 allows attackersEPSS 0.6%CVE-2026-9558CRITICALA Server-Side Template Injection (SSTI) vulnerability exists in Mautic's theme engine. The platform renders uploaded Twig templates without EPSS 0.6%