CVE-2024-22533

Before Beetl v3.15.12, the rendering template has a server-side template injection (SSTI) vulnerability. When the incoming template is controllable, it will be filtered by the DefaultNativeSecurityManager blacklist. Because blacklist filtering is not strict, the blacklist can be bypassed, leading to arbitrary code execution.

• CWE-94
• CWE-94

• https://gitee.com/xiandafu/beetl/issues/I8RU01Exploit, Issue Tracking, Vendor Advisory
• https://gitee.com/xiandafu/beetl/issues/I8RU01Exploit, Issue Tracking, Vendor Advisory

Published

Feb 2, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-22524dnspod-sr 0dfbd37 is vulnerable to buffer overflow.5.5
• CVE-2024-22525dnspod-sr 0dfbd37 contains a SEGV.5.5
• CVE-2024-22526Buffer Overflow vulnerability in bandisoft bandiview v7.0, a…5.5
• CVE-2024-22529TOTOLINK X2000R_V2 V2.0.0-B20230727.10434 has a command inje…9.8
• CVE-2024-2253The Testimonial Carousel For Elementor plugin for WordPress …6.4
• CVE-2024-22532Buffer Overflow vulnerability in XNSoft NConvert 7.163 (for …6.5
• CVE-2024-2254The RT Easy Builder – Advanced addons for Elementor plugin f…5.4
• CVE-2024-22543An issue was discovered in Linksys Router E1700 1.0.04 (buil…6.1
• CVE-2024-22544An issue was discovered in Linksys Router E1700 version 1.0.…8
• CVE-2024-22545An issue was discovered in TRENDnet TEW-824DRU version 1.04b…7.8
• CVE-2024-22546TRENDnet TEW-815DAP 1.0.2.0 is vulnerable to Command Injecti…6.4
• CVE-2024-22547WayOS IBR-7150 <17.06.23 is vulnerable to Cross Site Scripti…4.7