Tplmap
Tplmap is a command-line tool that detects and exploits server-side template injection vulnerabilities in web applications across multiple template engines.
Tplmap is a command-line tool that detects and exploits server-side template injection vulnerabilities in web applications across multiple template engines.
Checked October 2026.
Tplmap is a security testing tool designed to identify and exploit server-side template injection (SSTI) vulnerabilities and code injection flaws in web applications.
The tool automates the detection process by testing various template engines and injection techniques across different web application frameworks. It supports multiple template engines including Jinja2, Twig, Smarty, Velocity, and others commonly used in web development.
Tplmap provides exploitation capabilities once vulnerabilities are identified, allowing security professionals to demonstrate the impact of template injection flaws. The tool can execute system commands, read files, and perform other actions depending on the template engine and server configuration.
The tool operates through command-line interface and supports various HTTP methods and authentication mechanisms. It includes features for blind injection detection and can work with different payload encoding methods to bypass basic filtering mechanisms.
No core features are listed for this product yet, so check the vendor's documentation for the full feature list.
No integrations are listed for this product yet. Check the vendor's documentation, or ask the vendor which integrations and APIs it supports.
Common questions about Tplmap: features, pricing and alternatives.
Tplmap is a product in the Penetration Testing category. It covers Injection.
Tplmap is free. Download and setup instructions are at https://github.com/epinna/tplmap/.
Alternatives to Tplmap listed on CybersecTools:
Compare all Tplmap alternatives at https://cybersectools.com/alternatives/tplmap
Tplmap is available as on-premises software. It is listed for small businesses, mid-market companies and enterprises. It is free.
Side by side: features, pricing model and the company behind each one.
A login cracker that can be used to crack many types of authentication protocols.
A tool to profile web applications based on response time discrepancies.
Autonomous AI agent platform for pentesting, discovery, and remediation.
Multi-disciplinary security assessment service spanning app-sec, crypto, blockchain
A subdomain enumeration tool for penetration testers and security researchers.
A Burp Suite extension for sending large numbers of HTTP requests and analyzing the results.
Get a summary of this page from your assistant.
Mandos MCP: ask about all 9,033 products.
Connect your AI
