CVE-2022-37767

Pebble Templates 3.1.5 allows attackers to bypass a protection mechanism and implement arbitrary code execution with springbok. NOTE: the vendor disputes this because input to the Pebble templating engine is intended to include arbitrary Java code, and thus either the input should not arrive from an untrusted source, or else the application using the engine should apply restrictions to the input. The engine is not responsible for validating the input.

• CWE-863

• https://github.com/PebbleTemplates/pebble/issues/625#issuecomment-1282138635Exploit, Issue Tracking, Third Party Advisory
• https://github.com/Y4tacker/Web-Security/issues/3Exploit, Issue Tracking, Third Party Advisory
• https://github.com/PebbleTemplates/pebble/issues/625#issuecomment-1282138635Exploit, Issue Tracking, Third Party Advisory
• https://github.com/Y4tacker/Web-Security/issues/3Exploit, Issue Tracking, Third Party Advisory

Published

Sep 12, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-37730In ftcms 2.1, there is a Cross Site Request Forgery (CSRF) v…8.8
• CVE-2022-37731ftcms 2.1 poster.PHP has a XSS vulnerability. The attacker i…6.1
• CVE-2022-37734graphql-java before19.0 is vulnerable to Denial of Service. …7.5
• CVE-2022-3774A vulnerability was found in SourceCodester Train Scheduler …9.1
• CVE-2022-3775When rendering certain unicode sequences, grub2's font code …7.1
• CVE-2022-3776The Restaurant Menu – Food Ordering System – Table Reservati…8.8
• CVE-2022-37768libjpeg commit 281daa9 was discovered to contain an infinite…7.5
• CVE-2022-37769libjpeg commit 281daa9 was discovered to contain a segmentat…6.5
• CVE-2022-37770libjpeg commit 281daa9 was discovered to contain a segmentat…6.5
• CVE-2022-37771IObit Malware Fighter v9.2 for Microsoft Windows lacks tampe…6.7
• CVE-2022-37772Maarch RM 2.8.3 solution contains an improper restriction of…7.5
• CVE-2022-37773An authenticated SQL Injection vulnerability in the statisti…6.5