CVE-2026-108598
Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute comma
CVSS
9.8
Critical
EPSS
0.7%
p53
KEV
—
Exploit Today
16
0-100
Published: Oct 10, 2026 · Last modified: Oct 10, 2026 · CWE-94
Not enough EPSS history yet.
Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can create a REST API with a MOCK integration whose template uses $util reflection to reach Runtime or ProcessBuilder, executing OS commands in the Floci JVM.
- github.comhttps://github.com/floci-io/floci
- github.comhttps://github.com/floci-io/floci/blob/560b3e4aae61cea3ac7d4d51843bdffd0e3085fd/src/main/java/io/github/hectorvent/floci/services/apigateway/VtlTemplateEngine.java#L74-L114
- github.comhttps://github.com/floci-io/floci/commit/144b90e6fa861a5ac882e99a090d503da01945c4
- github.comhttps://github.com/floci-io/floci/releases/tag/2.2.0
- github.comhttps://github.com/floci-io/floci/security/advisories/GHSA-3p4c-wp7w-mgjx
- github.comhttps://github.com/ghostx-86/exploitarium/tree/main/floci-apigateway-vtl-rce-poc
- www.vulncheck.comhttps://www.vulncheck.com/advisories/floci-1.1.0-before-2.2.0-rce-via-api-gateway-vtl-mapping-templates
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1085663.5 LOW26.4%
——8A vulnerability has been found in InstantSoft icms2 up to 2.18.2. This issue affects the function index of the file templates/default/controllers/messages/index.tpl.php of the component Private Message Handler. Such manipulation of the argument nickname leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 3a1ec8fcb073a46d06a2ab83bc2bf68225834281. It is best practice to apply a patch to resolve this issue.19hCVE-2026-620986.5 MED9.6%
——3Unauthenticated Content Injection in Boutique <= 2.3.3 versions.16hCVE-2026-4269610.0 CRI46.6%
——14Unauthenticated Remote Code Execution (RCE) in SiteVault – Backup, Restore, Migration & Cloning <= 1.5.19 versions.16hCVE-2026-398028.1 HIG38.1%
——11Unauthenticated Remote Code Execution (RCE) in Everest Backup <= 2.3.13 versions.16hCVE-2026-1085936.4 MED17.4%
——59router 0.4.1 through 0.5.99 contains a configuration injection vulnerability in the POST /api/cli-tools/hermes-settings endpoint that allows authenticated dashboard users to inject arbitrary keys into the Hermes Agent config.yaml file. Attackers can submit a baseUrl containing double quotes and newlines to add hooks_auto_accept and a hooks.post_llm_call shell command, which Hermes Agent executes without approval after an LLM call.1dCVE-2026-1030717.5 HIG15.1%
——5Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Thank You Page Customizer for WooCommerce woo-thank-you-page-customizer allows Code Injection.This issue affects Thank You Page Customizer for WooCommerce: from n/a through 1.2.3.16h