FileSender before 2.49 allows server-side template injection (SSTI) for retrieving credentials.
CWE-94