CVE-2026-20217

ZendTo 6.15-8 / ClamAV exact-profile RCE and root-variant reproduction This directory is a standalone, authorized-lab reproduction bundle for the no-account ZendTo-to-ClamAV code-execution chain and its separate default- profile Smarty/root-cron continuation. It includes: the complete runnable Po...

CVE-2026-999999

X-Trading Portal: Regional Financial Infrastructure v1.4.2 Overview This repository contains the core distribution and deployment configurations for the X-Trading Portal XTP , a containerized solution designed for retail banking and stock trading services. This version v1.4.2 includes the updated...

CVE-2026-38725

xipblog module v2.0.1 and before for PrestaShop allows unauthenticated remote attackers to inject arbitrary JavaScript via the name and content parameters in ajax.php. The input is stored in the database without HTML sanitization and rendered in Smarty templates without output escaping, resulting...

PT-2026-83131

xipblog module v2.0.1 and before for PrestaShop allows unauthenticated remote attackers to inject arbitrary JavaScript via the name and content parameters in ajax.php. The input is stored in the database without HTML sanitization and rendered in Smarty templates without output escaping, resulting...

Exploit for Classic Buffer Overflow in Cisco Secure_Endpoint

ZendTo 6.15-8 / ClamAV exact-profile RCE and root-variant repr...

CVE-2026-62996

A flaw was found in Smarty, a PHP template engine. Smarty's stream resource-name handling does not adequately restrict which PHP stream wrappers and filter chains can be referenced from a template. An attacker able to author or influence a template's resource reference could exploit this by using...

CVE-2026-62996

Smarty is a template engine for PHP, facilitating the separation of presentation HTML/CSS from application logic. From 5.0.0 until 5.8.4, Smarty's stream: resource-name handling does not adequately restrict which PHP stream wrappers and filter chains can be referenced from a template, allowing a...

CVE-2026-62996 Smarty Security stream restriction bypass through stream: resource

Smarty is a template engine for PHP, facilitating the separation of presentation HTML/CSS from application logic. From 5.0.0 until 5.8.4, Smarty's stream: resource-name handling does not adequately restrict which PHP stream wrappers and filter chains can be referenced from a template, allowing a...

CVE-2026-62996 Smarty Security stream restriction bypass through stream: resource

Smarty is a template engine for PHP, facilitating the separation of presentation HTML/CSS from application logic. From 5.0.0 until 5.8.4, Smarty's stream: resource-name handling does not adequately restrict which PHP stream wrappers and filter chains can be referenced from a template, allowing a...

CVE-2026-62996

Smarty is a template engine for PHP, facilitating the separation of presentation HTML/CSS from application logic. From 5.0.0 until 5.8.4, Smarty's stream: resource-name handling does not adequately restrict which PHP stream wrappers and filter chains can be referenced from a template, allowing a...

CVE-2026-62992

Smarty (PHP template engine) prior to 5.8.2 and 4.5.7 (4.x line) is affected by a symlink path-traversal in Security::_checkDir() that does not fully resolve symbolic links before validating the directory containment. An attacker who can place or reference a symlink inside a trusted Smarty direct...

CVE-2026-62992

Smarty is a template engine for PHP, facilitating the separation of presentation HTML/CSS from application logic. Prior to 5.8.2 and 4.5.7 on the 4.x line, Security::checkDir does not fully resolve symbolic links before validating that a requested path lies within a configured secure directory. A...

CVE-2026-54390: Improper Neutralization of Special Elements Used in a Template Engine

JTL Shop versions 5.2.0 through 5.7.1 contains a server-side template injection vulnerability that allows unauthenticated attackers to inject malicious template syntax due to unsanitized user-supplied input passed to the Smarty template engine. Attackers can exploit this flaw to read sensitive...

PT-2026-50772

Name of the Vulnerable Software and Affected Versions JTL Shop versions 5.2.0 through 5.7.1 Description Unauthenticated attackers can inject malicious template syntax because unsanitized user-supplied input is passed to the Smarty template engine, a tool used to generate dynamic web content. This...

CVE-2026-45714

CubeCart is an ecommerce software solution. Prior to 6.7.0, an Authenticated Server-Side Template Injection SSTI vulnerability exists in multiple modules of CubeCart including Email Templates, Invoices, Documents, and Contact Forms. The application unsafely evaluates user-supplied input using the...

CVE-2026-45714

CubeCart is an ecommerce software solution. Prior to 6.7.0, an Authenticated Server-Side Template Injection SSTI vulnerability exists in multiple modules of CubeCart including Email Templates, Invoices, Documents, and Contact Forms. The application unsafely evaluates user-supplied input using the...

EUVD-2026-30176

CubeCart is an ecommerce software solution. Prior to 6.7.0, an Authenticated Server-Side Template Injection SSTI vulnerability exists in multiple modules of CubeCart including Email Templates, Invoices, Documents, and Contact Forms. The application unsafely evaluates user-supplied input using the...

CVE-2026-44377

CubeCart is an ecommerce software solution. Prior to 6.7.0, an Authenticated Server-Side Template Injection SSTI vulnerability exists in multiple modules of CubeCart including Email Templates and Documents. The application unsafely evaluates user-supplied input directly through the Smarty templat...

EUVD-2026-30165

CubeCart is an ecommerce software solution. Prior to 6.7.0, an Authenticated Server-Side Template Injection SSTI vulnerability exists in multiple modules of CubeCart including Email Templates and Documents. The application unsafely evaluates user-supplied input directly through the Smarty templat...

CVE-2026-44377: Improper Control of Generation of Code

CubeCart is an ecommerce software solution. Prior to 6.7.0, an Authenticated Server-Side Template Injection SSTI vulnerability exists in multiple modules of CubeCart including Email Templates and Documents. The application unsafely evaluates user-supplied input directly through the Smarty templat...