https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-15T09:42:25.025458+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-110593 CVE-2026-110593 — BottleCRM through 1.14.5 Server-Side Template Injection via Account Email create_mail 2026-10-15T09:42:25.026356+00:00

Affected: MicroPyramid BottleCRM

BottleCRM through 1.14.5 contains a server-side template injection vulnerability in the send_email Celery task, which compiles the user-supplied AccountEmail message_body with django.template.Template(). Authenticated organization members can submit template tags through POST /api/accounts/<id>/create_mail/ to disclose the rendering context and loaded Python modules, or block the shared Celery worker with nested loops.