SQL Injection Vulnerability in UQCMS Cloud Business System (CNVD-2020-26524)

UQCMS cloud business system is programmed with PHP + MYSQL, the template uses smarty templates, the front and back end is separated from a B2B2C e-commerce software. UQCMS Cloud Business System has a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive information...

SQL injection vulnerability in the front-end me***.cl***.php page of UQCMS cloud business system

UQCMS cloud business system is programmed with PHP + MYSQL, the template uses smarty templates, the front and back end is separated from a B2B2C e-commerce software. SQL injection vulnerability exists in the front-end me.cl.php page of UQCMS Cloud Business System. An attacker can exploit the...

SRC-2021-0002 : CSCart templates.manage Server Side Template Injection Remote Code Execution Vulnerability

Vulnerability Details: This vulnerability allows remote attackers to execute arbitrary code on affected installations of CSCart. Authentication is required to exploit this vulnerability with the Files privilege. The specific flaw exists within the templates.manage dispatch method. The issue resul...

PT-2019-6613

Name of the Vulnerable Software and Affected Versions Smarty3 affected versions not specified Description The issue allows attackers to possibly execute arbitrary PHP code via the sysplugins/smarty internal compile private special variable.php file. This is related to the $smarty.template variabl...

SQL injection vulnerability in UQCMS de***.php page

UQCMS cloud business system is a B2B2C e-commerce software with the program using PHP+MYSQL and the template using smarty template. A SQL injection vulnerability exists in the UQCMS de.php page, which can be exploited by attackers to obtain sensitive information from the database...

SQL injection vulnerability in UQCMS aj***.php page (CNVD-2019-43616)

UQCMS cloud business system is a B2B2C e-commerce software that the program uses PHP+MYSQL and the template uses smarty template. A SQL injection vulnerability exists in the UQCMS aj.php page, which can be exploited by attackers to obtain sensitive information from the database...

CVE-2008-1066

The modifier.regexreplace.php plugin in Smarty before 2.6.19, as used by Serendipity S9Y and other products, allows attackers to call arbitrary PHP functions via templates, related to a '\0' character in a search string...

CVE-2008-4810

The expandquotedtext function in libs/SmartyCompiler.class.php in Smarty 2.6.20 before r2797 allows remote attackers to execute arbitrary PHP code via vectors related to templates and 1 a dollar-sign character, aka "php executed in templates;" and 2 a double quoted literal string, aka a "function...

Fedora Update for php-Smarty FEDORA-2019-e595e8a7d7

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 30 Update: python-jinja2-2.10.1-1.fc30

Jinja2 is a template engine written in pure Python. It provides a Django inspired non-XML syntax but supports inline expressions and an optional sandboxed environment. If you have any exposure to other text-based template languages, such as Smarty or Django, you should feel right at home with...

Fedora 28 : php-Smarty (2019-d248c5aa39)

===== 3.1.33 release ===== 12.09.2018 ===== 3.1.33-dev-12 ===== 03.09.2018 - bugfix foreach using new style property access like $item@property on Smarty 2 style named foreach loop could produce errors https://github.com/smarty-php/smarty/issues/484 Note that Tenable Network Security has extracte...

Fedora 29 : php-Smarty (2019-e595e8a7d7)

===== 3.1.33 release ===== 12.09.2018 ===== 3.1.33-dev-12 ===== 03.09.2018 - bugfix foreach using new style property access like $item@property on Smarty 2 style named foreach loop could produce errors https://github.com/smarty-php/smarty/issues/484 Note that Tenable Network Security has extracte...

Fedora Update for php-Smarty FEDORA-2019-d248c5aa39

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 28 Update: php-Smarty-3.1.33-1.fc28

Smarty is a template engine for PHP, facilitating the separation of presentation HTML/CSS from application logic. This implies that PHP code is application logic, and is separated from the presentation. Autoloader: /usr/share/php/Smarty/autoload.php...

[SECURITY] Fedora 29 Update: php-Smarty-3.1.33-1.fc29

Smarty is a template engine for PHP, facilitating the separation of presentation HTML/CSS from application logic. This implies that PHP code is application logic, and is separated from the presentation. Autoloader: /usr/share/php/Smarty/autoload.php...

PHP Code Injection

smarty-php/smarty is vulnerable to PHP code injection attacks. The vulnerability exists as the template names are unsanitized when called from fetch or display, allowing PHP code injection attacks...

DouCo DouPHP Information Disclosure Vulnerability

DouCo DouPHP is a lightweight open source CMS Content Management System based on PHP and MySQL. A security vulnerability exists in DouCo DouPHP version 1.5 20181221. An attacker can exploit the vulnerability to obtain the full path in the error message 'Smarty error: unable to read resource' with...

CVE-2018-20566

An issue was discovered in DouCo DouPHP 1.5 20181221. It allows full path disclosure in "Smarty error: unable to read resource" error messages for a crafted installation page...

CVE-2018-20566

An issue was discovered in DouCo DouPHP 1.5 20181221. It allows full path disclosure in "Smarty error: unable to read resource" error messages for a crafted installation page...

Path traversal

An issue was discovered in DouCo DouPHP 1.5 20181221. It allows full path disclosure in "Smarty error: unable to read resource" error messages for a crafted installation page...