Arbitrary Code Injection

smarty/smarty is vulnerable to arbitrary code injection. The vulnerability exists in smartyfunctionmath function of function.math.php because the math strings are not validated which allows an attacker to send and execute crafted malicious math strings...

CVE-2009-1669

CVE-2009-1669 affects the Smarty template engine (Smarty 2.6.22) via the smarty_function_math plugin. The vulnerability allows a context-dependent attacker to execute arbitrary commands through shell metacharacters placed in the equation attribute of the math function, enabling remote code execut...