TI-2025-36901 CVE-2025-59340 · GHSA-m49c-g9wr-hv6v
jinjava Sandbox Bypass via JavaType-Based Deserialization
Priority MEDIUM 53
jinjava is a Java-based template engine based on django template syntax, adapted to render jinja templates.
HubSpot
Records8All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9
Exploited now
HubSpot records in CISA KEVNo HubSpot vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
8 records
TI-2026-20635 CVE-2026-25526 · GHSA-gjx9-j8f8-7j74
JinJava Bypass through ForTag leads to Arbitrary Java Execution
Priority MEDIUM 51
JinJava is a Java-based template engine based on django template syntax, adapted to render jinja templates.
TI-2022-01126 CVE-2022-1239 · GHSA-mqqr-fmxw-ghxx
HubSpot < 8.8.15 - Contributor+ Blind SSRF
Priority MEDIUM 41
The HubSpot WordPress plugin before 8.8.15 does not validate the proxy URL given to the proxy REST endpoint, which could allow users with the edit_posts capability (by default contributor and above) to perform SSRF attac…
TI-2017-11756 CVE-2017-16035 · GHSA-h8mc-42c3-r72p
Cleartext transmission of sensitive information in HackerOne hubl-server node module
Priority LOW 36
The hubl-server module is a wrapper for the HubL Development Server.
TI-2026-41560 CVE-2026-57736 · GHSA-j6hf-cv7p-rr4m
WordPress HubSpot plugin <= 11.3.51 - Sensitive Data Exposure vulnerability
Priority LOW 32
Insertion of Sensitive Information Into Sent Data vulnerability in HubSpot allows Retrieve Embedded Sensitive Data.
TI-2020-10073 CVE-2020-12668 · GHSA-2hjr-fg6c-v2h6
Jinjava before 2.5.4 allow access to arbitrary classes by calling Java methods on objects…
Priority LOW 32
Jinjava before 2.5.4 allow access to arbitrary classes by calling Java methods on objects passed into a Jinjava context.
TI-2024-05452 CVE-2024-5879 · GHSA-3826-h8f4-w96h
Cross-site scripting in hubspotdev HubSpot All-In-One Marketing – Forms, Popups, Live Chat
Priority LOW 29
The HubSpot – CRM, Email Marketing, Live Chat, Forms & Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' attribute of the HubSpot Meeting Widget in all versions up to, and includin…
TI-2018-13389 CVE-2018-18893 · GHSA-45r8-3495-x6rm
Jinjava before 2.4.6 does not block the getClass method, related to…
Priority LOW 28
Jinjava before 2.4.6 does not block the getClass method, related to com/hubspot/jinjava/el/ext/JinjavaBeanELResolver.java.