PRODUCT PROFILE

ejs

暂无产品描述。

ejsnode.js

关联漏洞

共找到 2 条公开漏洞记录

严重CVE-2023-298272023/05/04

Embedded JavaScript(EJS) 3.1.6 - Template Injection

ejs v3.1.9 is vulnerable to server-side template injection. If the ejs file is controllable, template injection can be implemented through the configuration settings of the closeDelimiter parameter.

ejsPoC 已收录RCE

CVSS9.8EPSS 69.6%

严重CVE-2022-290782022/04/25

Node.js Embedded JavaScript 3.1.6 - Template Injection

Node.js Embedded JavaScript 3.1.6 is susceptible to server-side template injection via settings[view options][outputFunctionName], which is parsed as an internal option and overwrites the outputFunctionName option with an arbitrary OS command, which is then executed upon template compilation.

ejsPoC 已收录RCE

CVSS9.8EPSS 93.5%