CVE-2025-60355
Critical · 9.8CVSS
9.8
EPSS
0.5%
Published
Oct 28, 2025
CISA due date
—
The record
zhangyd-c OneBlog v2.3.9 and before was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-96392 Improper Neutralization of Special Elements Used in a Template Engine vulnerability in… CWE-1336
- CVE-2026-96355 Improper Neutralization of Special Elements Used in a Template Engine vulnerability in… CWE-1336
- CVE-2026-104851 fsspec is a specification and Python implementation framework for filesystem interfaces. CWE-1336
- CVE-2026-9160 Improper neutralization of special elements used in a template engine vulnerability in… CWE-1336
- CVE-2026-19584 Velociraptor allows for the creation of notebook backups in its default enabled daily… CWE-1336
- CVE-2026-75650 Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a… CWE-1336
- CVE-2026-52762 YesWiki is a wiki system written in PHP. CWE-1336
- CVE-2026-85654 Improper neutralization of special elements used in a template engine in the CDK… CWE-1336