731 matches found
CVE-2021-43674
ThinkUp 2.0-beta.10 is affected by a path manipulation vulnerability in Smarty.class.php. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...
CVE-2021-43674
ThinkUp 2.0-beta.10 is affected by a path manipulation vulnerability in Smarty.class.php. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...
matyhtf 路径遍历漏洞
matyhtf is a PHP framework based on the Swoole extension. A security vulnerability exists in matyhtf that stems from matyhtf framework v3.0.5 being affected by a path manipulation vulnerability in Smarty.class.php...
ThinkUp 路径遍历漏洞
ThinkUp is a free, installable web application from ThinkUp USA, Inc. Used to gain insight into activity on social networks such as Twitter, Facebook and Instagram, ThinkUp has a security vulnerability that stems from the fact that ThinkUp 2.0-beta is affected by a path manipulation vulnerability...
CMS Made Simple Cross-Site Scripting Vulnerability (CNVD-2021-57425)
CMS Made Simple is a simple and easy-to-use content management system developed using PHP, MySQL and Smarty template engine.A cross-site scripting vulnerability exists in CMS Made Simple version 2.2.14. The vulnerability can be exploited by attackers to conduct cross-site scripting attacks via th...
Bacula-Web -- Multiple Vulnerabilities
Bacula-Web reports: Address Smarty CVE...
MGASA-2021-0335 Updated php-smarty package fixes security vulnerabilities
Smarty before 3.1.39 allows a Sandbox Escape because $smarty.templateobject can be accessed in sandbox mode CVE-2021-26119. Smarty before 3.1.39 allows code injection via an unexpected function name after a function name= substring CVE-2021-26120...
Updated php-smarty package fixes security vulnerabilities
Smarty before 3.1.39 allows a Sandbox Escape because $smarty.templateobject can be accessed in sandbox mode CVE-2021-26119. Smarty before 3.1.39 allows code injection via an unexpected function name after a function name= substring CVE-2021-26120...
WeedCMS 5.6 Build 20111203 Exists Logic Flaw Vulnerability
Weed website management system WEEDCMS is a content management system developed independently by Weed based on PHP + MYSQL. Oriented enterprises , individuals , small portals and other small and medium-sized site use and development . Using the international popular Smarty engine and agile JQuery...
GLSA-202105-06 : Smarty: Multiple vulnerabilities
The remote host is affected by the vulnerability described in GLSA-202105-06 Smarty: Multiple vulnerabilities Multiple vulnerabilities have been discovered in Smarty template engine. Please review the CVE identifiers referenced below for details. Impact : Please review the referenced CVE...
Smarty: Multiple vulnerabilities
Background Smarty is a template engine for PHP. Description Multiple vulnerabilities have been discovered in Smarty template engine. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround There is no known...
PT-2021-6745 · Smarty +2 · Smarty +2
Name of the Vulnerable Software and Affected Versions: Smarty versions prior to 3.1.42 and 4.0.2 Description: The issue is related to the incorrect handling of code generation in the Smarty template engine for PHP. This allows template authors to run arbitrary PHP code by crafting a malicious mat...
GHSA-W5HR-JM4J-9JVQ Sandbox escape through template_object in smarty
Sandbox protection could be bypassed through access to an internal Smarty object that should have been blocked. Sites that rely on Smarty Security features should upgrade as soon as possible. Please upgrade to 3.1.39 or higher...
Sandbox escape through template_object in smarty
Sandbox protection could be bypassed through access to an internal Smarty object that should have been blocked. Sites that rely on Smarty Security features should upgrade as soon as possible. Please upgrade to 3.1.39 or higher...
PHP Code Injection by malicious function name in smarty
Template authors could inject php code by choosing a malicous function name. Sites that cannot fully trust template authors should update as soon as possible. Please upgrade to 3.1.39 or higher...
GHSA-3RPF-5RQV-689Q PHP Code Injection by malicious function name in smarty
Template authors could inject php code by choosing a malicous function name. Sites that cannot fully trust template authors should update as soon as possible. Please upgrade to 3.1.39 or higher...
Privilege Escalation
smarty/smarty is vulnerable to privilege escalation. An attacker is able to access smarty.templateobject in sandbox mode...
Remote Code Execution (RCE)
Smarty is vulnerable to remote code execution. The library does not properly handle the illegal function names in function name='blah'/function, allowing a malicious user to inject and execute arbitrary commands...