Smarty 输入验证错误漏洞

Smarty is Smarty is a template engine for PHP that facilitates the separation of representation HTML/CSS from application logic. A security vulnerability exists in Smarty that stems from Smarty is a template engine for PHP that facilitates the separation of representation HTML CSS from applicatio...

PT-2022-9201 · Smarty +2 · Smarty +2

Name of the Vulnerable Software and Affected Versions: Smarty versions prior to 3.1.43 Smarty versions prior to 4.0.3 Description: Smarty is a template engine for PHP that facilitates the separation of presentation from application logic. Template authors could run restricted static php methods...

CVE-2021-29454 Sandbox Escape by math function in smarty

Smarty is a template engine for PHP, facilitating the separation of presentation HTML/CSS from application logic. Prior to versions 3.1.42 and 4.0.2, template authors could run arbitrary PHP code by crafting a malicious math string. If a math string was passed through as user provided data to the...

PT-2021-6745 · Smarty +2 · Smarty +2

Name of the Vulnerable Software and Affected Versions: Smarty versions prior to 3.1.42 and 4.0.2 Description: The issue is related to the incorrect handling of code generation in the Smarty template engine for PHP. This allows template authors to run arbitrary PHP code by crafting a malicious mat...

Simon Wisselink Smarty 代码注入漏洞

The Smart template engine is one of the most famous PHP engines in the industry today. It provides an easy-to-manage way to separate business logic from presentation logic. A vulnerability has been reported in the Smart Template Engine, which allows an attacker to write to a cache file via the...

PT-2021-6791 · Smarty +2 · Smarty +2

Name of the Vulnerable Software and Affected Versions: Smarty versions prior to 3.1.39 Description: The issue is related to incorrect code generation handling when processing invalid function names in the Smarty template engine for PHP. This can allow a remote attacker to execute arbitrary code...

Smarty_Internal_Runtime_TplFunction Sandbox Escape PHP Code Injection

More info at https://srcincite.io/blog/2021/02/18/smarty-template-engine-multiple-sandbox-escape-vulnerabilities.html...

template_object Sandbox Escape PHP Code Injection

More info at https://srcincite.io/blog/2021/02/18/smarty-template-engine-multiple-sandbox-escape-vulnerabilities.html...

SRC-2021-0010 : Smarty Template Engine Smarty_Internal_Runtime_TplFunction Sandbox Escape Remote Code Execution Vulnerability

Vulnerability Details: This vulnerability allows remote attackers execute arbitrary code on affected installations of Smarty Template Engine. Authentication is context dependant and may not be required to exploit this vulnerability. The specific flaw exists within the SmartyInternalCompileFunctio...

SRC-2021-0009 : Smarty Template Engine template_object Sandbox Escape Remote Code Execution Vulnerability

Vulnerability Details: This vulnerability allows remote attackers execute arbitrary code on affected installations of Smarty Template Engine. Authentication is context dependant and may not be required to exploit this vulnerability. The specific flaw exists within the...

Directory Traversal Vulnerability in KuaiFanCMS

KuaiFanCMS is developed using PHP5+MYSQL as the technical base. kf is built using Smarty template engine. KuaiFanCMS has a directory traversal vulnerability that can be exploited by attackers to obtain sensitive information...

Smarty PHP Code Injection Vulnerability

New Digital Group Smarty is a template engine written in PHP by New Digital Group. A PHP code injection vulnerability exists in New Digital Group Smarty that stems from the program failing to filter template names. No details of the vulnerability are available at this time...

Smarty vulnerable to cross-site scripting

Overview Smarty contains a cross-site scripting vulnerability. Smarty is a template engine for PHP. Smarty contains a cross-site scripting vulnerability when displaying an error message. Yuji Tounai of bogus.jp reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under...

Smarty Template Engine 2.6.9 - $smarty.template PHP Code Injection

Smarty Template Engine 2.6.9 - $smarty.template PHP Code Injection source: https://www.securityfocus.com/bid/46366/info Smarty Template Engine is prone to a remote PHP code-injection vulnerability. An attacker can exploit this issue to inject and execute arbitrary PHP code in the context of the...

1 1 4. Site Navigation Station system of V1. 1 3 XSS cross-site attacks-vulnerability warning-the black bar safety net

url-submit/index. php to submit the data is not filtered directly into the database,resulting in a savings ofXSSvulnerability Test method: In the Site Name column fill in thescript src=http://www. hackqing. cn/qingexp. js/script（src is fill in your own js file for the address,don't tell me that t...