CVE-2026-62996

creationtimestamp| type| source ---|---|--- 2026-08-07 16:35:38+00:00| published-proof-of-concept| https://github.com/smarty-php/smarty/security/advisories/GHSA-rjhh-76wf-8xmw...

CVE-2021-21408 Access to restricted PHP code by dynamic static class access in smarty

Smarty is a template engine for PHP, facilitating the separation of presentation HTML/CSS from application logic. Prior to versions 3.1.43 and 4.0.3, template authors could run restricted static php methods. Users should upgrade to version 3.1.43 or 4.0.3 to receive a patch...

PHP Code Injection

smarty-php/smarty is vulnerable to PHP code injection attacks. The vulnerability exists as the template names are unsanitized when called from fetch or display, allowing PHP code injection attacks...

CVE-2012-4437: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the SmartyException class in Smarty aka smarty-php before 3.1.12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors that trigger a Smarty exception...

PT-2005-2672 · Postnuke · Postnuke

Name of the Vulnerable Software and Affected Versions: PostNuke versions 0.750 through 0.760RC3 Description: The issue allows remote attackers to obtain sensitive information via a direct request to "simple smarty.php", which reveals the path in an error message. Recommendations: For PostNuke...