CVE-2024-32651

CRITICAL Year: 2024
CVSS v3 Score
10.0
Critical
Weakness Type
CWE-1336
View all →

Vulnerability Description

changedetection.io is an open source web page change detection, website watcher, restock monitor and notification service. There is a Server Side Template Injection (SSTI) in Jinja2 that allows Remote Command Execution on the server host. Attackers can run any system command without any restriction and they could use a reverse shell. The impact is critical as the attacker can completely takeover the server machine. This can be reduced if changedetection is behind a login page, but this isn't required by the application (not by default and not enforced).

Related Vulnerabilities

CVE-2023-6709

CRITICAL
CVSS:10.0(Critical)

Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository mlflow/mlflow prior to 2.9.2.

CWE-13362023

CVE-2024-4040

CRITICAL
CVSS:10.0(Critical)

A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside o...

CWE-13362024

CVE-2025-47916

CRITICAL
CVSS:10.0(Critical)

Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php. The issue lies within the themeeditor controller (file: /applications/core/modules/f...

CWE-13362025

CVE-2024-12583

CRITICAL
CVSS:9.9(Critical)

The Dynamics 365 Integration plugin for WordPress is vulnerable to Remote Code Execution and Arbitrary File Read in all versions up to, and including, 1.3.23 via Twig Server-Side Template Injection. T...

CWE-13362024

CVE-2024-37301

CRITICAL
CVSS:9.9(Critical)

Document Merge Service is a document template merge service providing an API to manage templates and merge them with given data. Versions 6.5.1 and prior are vulnerable to remote code execution via se...

CWE-13362024

CVE-2025-23211

CRITICAL
CVSS:9.9(Critical)

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. A Jinja2 SSTI vulnerability allows any user to execute commands on the server. In the case of the p...

CWE-13362025