pwnig all the (web)things
App with Server Side Template Injection (SSTI) vulnerability - possible RCE - in Flask. Free vulnerable app for ethical hacking / penetration testing training.
Phishing framework for pentesting
Deterministic input sanitization for untrusted text — invisible characters, homoglyphs, and encoding tricks, handled before your code sees them. Zero dependencies, no ML. Python 3.12+.
The simplest example of a template injection vulnerability
C++ and VB implementation of microsoft template injection vulnerability.
Sandbox for studying Server-Side and Client-Side Template Injections (SSTI & CSTI) with Flask and AngularJS.
CVE-2026-33937 Handlebars RCE exploit PoC (AST Injection)
In-browser scanner for server-rendered data sitting inside client-side template bindings (CSTI / XSS) in Vue, Angular and ERB. Runs entirely in the browser, nothing is uploaded.
A simple lab created for testing CSTI vulnerability in AngularJS version 1.0.8, 1.3.20 and 1.5.8 using Sandbox Escape.
To associate your repository with the template-injection topic, visit your repo's landing page and select "manage topics."