Ssti — PoC Archivehttps://poc.intelseclab.com/tags/ssti/Latest proof-of-concept entries.Hugoen-usMon, 06 Jul 2026 00:00:00 +0000Invision Community Theme Editor Template Injection Unauthenticated RCE (CVE-2025-47916)https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-47916-invision-community-template-injection-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-47916-invision-community-template-injection-rce/Critical severity (CVSS 10) — web · CVE-2025-47916. Status: Weaponized. Affects: Invision Community, themeeditor front controller (IPS\core\modules\front\system\themeeditor::customCss()). Tags: invision-community, ssti, template-injection, theme-editor, unauthenticated-rce, php, cwe-94, python.webCriticalinvision-communitysstitemplate-injectiontheme-editorunauthenticated-rcephpcwe-94pythonCrafty Controller Webhook Jinja2 Server-Side Template Injection RCE (CVE-2025-14700)https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-14700-crafty-controller-ssti-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-14700-crafty-controller-ssti-rce/Critical severity (CVSS 9.9) — web · CVE-2025-14700. Status: Weaponized. Affects: Crafty Controller (Minecraft server management panel). Tags: crafty-controller, minecraft, jinja2, ssti, server-side-template-injection, reverse-shell, tornado, xsrf, python, cwe-1336.webCriticalcrafty-controllerminecraftjinja2sstiserver-side-template-injectionreverse-shelltornadoxsrfpythoncwe-1336Thymeleaf SpEL Injection Remote Code Execution (CVE-2026-41901)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-41901-thymeleaf-spel-injection-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-41901-thymeleaf-spel-injection-rce/Critical severity — web · CVE-2026-41901. Status: PoC. Affects: Spring Boot application using Thymeleaf template engine. Tags: thymeleaf, spel-injection, ssti, spring-boot, rce, java, template-injection.webCriticalthymeleafspel-injectionsstispring-bootrcejavatemplate-injectionShopware Twig Rendered-View Code Injection Regression (CVE-2026-23498)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-23498-shopware-twig-code-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-23498-shopware-twig-code-injection/High severity — web · CVE-2026-23498. Status: PoC. Affects: Shopware (shopware/shopware, shopware/core). Tags: shopware, twig, code-injection, ssti, php, cwe-94, regression, template-sandbox-bypass.webHighshopwaretwigcode-injectionsstiphpcwe-94regressiontemplate-sandbox-bypassJinjava Server-Side Template Injection to RCE via Jackson ObjectMapper (CVE-2026-25526)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-25526-jinjava-ssti-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-25526-jinjava-ssti-rce/Critical severity — web · CVE-2026-25526. Status: Weaponized. Affects: Jinjava (HubSpot's Java Jinja-like template engine). Tags: ssti, jinjava, java, jackson, objectmapper, sandbox-escape, rce, deserialization.webCriticalsstijinjavajavajacksonobjectmappersandbox-escapercedeserializationContact Form by Supsystic <= 1.7.36 Unauthenticated SSTI to RCE (CVE-2026-4257)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-4257-supsystic-contact-form-ssti-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-4257-supsystic-contact-form-ssti-rce/Critical severity — web · CVE-2026-4257. Status: PoC. Affects: Contact Form by Supsystic (WordPress plugin). Tags: wordpress, contact-form-by-supsystic, ssti, twig, rce, unauthenticated, prefill.webCriticalwordpresscontact-form-by-supsysticsstitwigrceunauthenticatedprefillApache Solr Velocity Template Injection RCE (CVE-2026-44825)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-44825-apache-solr-velocity-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-44825-apache-solr-velocity-rce/Critical severity (CVSS 9.8) — web · CVE-2026-44825. Status: PoC. Affects: Apache Solr (VelocityResponseWriter / wt=velocity). Tags: apache-solr, velocity, ssti, template-injection, rce, java, default-credentials.webCriticalapache-solrvelocitysstitemplate-injectionrcejavadefault-credentialsConfluence SSTI RCE - CVE-2023-22527https://poc.intelseclab.com/pocs/web/2026-05-17_confluence-ssti-rce-cve-2023-22527/Sun, 17 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-05-17_confluence-ssti-rce-cve-2023-22527/Critical severity (CVSS 10) — web · CVE-2023-22527. Status: Weaponized. Affects: Atlassian Confluence Data Center and Confluence Server. Tags: RCE, Confluence, SSTI, Freemarker, OGNL, unauthenticated, Java, Atlassian, ransomware.webCriticalRCEConfluenceSSTIFreemarkerOGNLunauthenticatedJavaAtlassianransomware