CVE-2021-23803

This affects the package latte/latte before 2.10.6. There is a way to bypass allowFunctions that will affect the security of the application. When the template is set to allow/disallow the use of certain functions, adding control characters (x00-x08) after the function will bypass these restrictions.

• CWE-863

• https://github.com/nette/latte/commit/227c86eda9a8a6d060ea8501923e768b6d992210Patch, Third Party Advisory
• https://github.com/nette/latte/issues/279Exploit, Issue Tracking, Patch, Third Party Advisory
• https://snyk.io/vuln/SNYK-PHP-LATTELATTE-1932226Exploit, Patch, Third Party Advisory
• https://github.com/nette/latte/commit/227c86eda9a8a6d060ea8501923e768b6d992210Patch, Third Party Advisory
• https://github.com/nette/latte/issues/279Exploit, Issue Tracking, Patch, Third Party Advisory
• https://snyk.io/vuln/SNYK-PHP-LATTELATTE-1932226Exploit, Patch, Third Party Advisory

Published

Dec 17, 2021

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-23772This affects all versions of package github.com/kataras/iris…8.8
• CVE-2021-2378Vulnerability in the Oracle WebLogic Server product of Oracl…7.5
• CVE-2021-23784This affects the package tempura before 0.4.0. If the input …6.1
• CVE-2021-23792The package com.twelvemonkeys.imageio:imageio-metadata befor…9.8
• CVE-2021-23797All versions of package http-server-node are vulnerable to D…9.8
• CVE-2021-2380Vulnerability in the Oracle Applications Framework product o…7.6
• CVE-2021-23807This affects the package jsonpointer before 5.0.0. A type co…9.8
• CVE-2021-2381Vulnerability in the Oracle Solaris product of Oracle System…3.9
• CVE-2021-23814This affects versions of the package unisharp/laravel-filema…8.8
• CVE-2021-2382Vulnerability in the Oracle WebLogic Server product of Oracl…9.8
• CVE-2021-23820This affects all versions of package json-pointer. A type co…9.8
• CVE-2021-23824This affects the package Crow before 0.3+4. When using attri…6.1