https://poc.intelseclab.com/tags/template-injection/Latest proof-of-concept entries.Hugoen-usMon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-47916-invision-community-template-injection-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-47916-invision-community-template-injection-rce/Critical severity (CVSS 10) — web · CVE-2025-47916. Status: Weaponized. Affects: Invision Community, themeeditor front controller (IPS\core\modules\front\system\themeeditor::customCss()). Tags: invision-community, ssti, template-injection, theme-editor, unauthenticated-rce, php, cwe-94, python.webCriticalinvision-communitysstitemplate-injectiontheme-editorunauthenticated-rcephpcwe-94pythonhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-41901-thymeleaf-spel-injection-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-41901-thymeleaf-spel-injection-rce/Critical severity — web · CVE-2026-41901. Status: PoC. Affects: Spring Boot application using Thymeleaf template engine. Tags: thymeleaf, spel-injection, ssti, spring-boot, rce, java, template-injection.webCriticalthymeleafspel-injectionsstispring-bootrcejavatemplate-injectionhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-36239-pbootcms-authenticated-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-36239-pbootcms-authenticated-rce/Critical severity — web · CVE-2026-36239. Status: Weaponized. Affects: PbootCMS. Tags: pbootcms, rce, authenticated, code-injection, template-injection, cwe-94.webCriticalpbootcmsrceauthenticatedcode-injectiontemplate-injectioncwe-94https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-33937-handlebars-ast-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-33937-handlebars-ast-rce/Critical severity — web · CVE-2026-33937. Status: PoC. Affects: Handlebars (Node.js templating engine). Tags: handlebars, rce, template-injection, ast-injection, nodejs, express, javascript-compiler, code-generation.webCriticalhandlebarsrcetemplate-injectionast-injectionnodejsexpressjavascript-compilercode-generationhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-33657-espocrm-stored-html-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-33657-espocrm-stored-html-injection/Medium severity — web · CVE-2026-33657. Status: PoC. Affects: EspoCRM 9.3.3. Tags: espocrm, html-injection, stored-xss, cwe-80, email-notifications, authenticated, crm, template-injection.webMediumespocrmhtml-injectionstored-xsscwe-80email-notificationsauthenticatedcrmtemplate-injectionhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-39387-boidcms-file-upload-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-39387-boidcms-file-upload-rce/High severity — web · CVE-2026-39387. Status: Weaponized. Affects: BoidCMS. Tags: boidcms, php, authenticated, file-upload, path-traversal, template-injection, rce.webHighboidcmsphpauthenticatedfile-uploadpath-traversaltemplate-injectionrcehttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-44825-apache-solr-velocity-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-44825-apache-solr-velocity-rce/Critical severity (CVSS 9.8) — web · CVE-2026-44825. Status: PoC. Affects: Apache Solr (VelocityResponseWriter / wt=velocity). Tags: apache-solr, velocity, ssti, template-injection, rce, java, default-credentials.webCriticalapache-solrvelocitysstitemplate-injectionrcejavadefault-credentials