Ejs - vulnerabilities (CVEs)

5 CVEs in 1 products, 0 in the last 30 days, newest from 2023-05-04.

Products

• Ejs - 5 CVEs

Newest CVEs of Ejs

• CVE-2023-29827 - CVSS 9.8 (critical), 2023-05-04: ejs v3.1.9 is vulnerable to server-side template injection. If the ejs file is controllable, template injection can be implemented through the configuration…
• CVE-2022-29078 - CVSS 9.8 (critical), 2022-04-25: The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName].…
• CVE-2017-1000188 - CVSS 6.1 (medium), 2017-11-17: nodejs ejs version older than 2.5.5 is vulnerable to a Cross-site-scripting in the ejs.renderFile() resulting in code injection
• CVE-2017-1000228 - CVSS 9.8 (critical), 2017-11-17: nodejs ejs versions older than 2.5.3 is vulnerable to remote code execution due to weak input validation in ejs.renderFile() function
• CVE-2017-1000189 - CVSS 7.5 (high), 2017-11-17: nodejs ejs version older than 2.5.5 is vulnerable to a denial-of-service due to weak input validation in the ejs.renderFile()