716 matches found
CVE-2021-26119
Smarty before 3.1.39 allows a Sandbox Escape because $smarty.templateobject can be accessed in sandbox mode...
CVE-2021-26119
Smarty before 3.1.39 allows a Sandbox Escape because $smarty.templateobject can be accessed in sandbox mode...
CVE-2021-26119
CVE-2021-26119 affects Smarty before 3.1.39. The vulnerability allows a Sandbox Escape because the $smarty.template_object can be accessed in sandbox mode, enabling potential escalation of privileges within PHP templates. Supported by multiple advisories (Debian/Mageia/GHSA) confirming the fix in...
Simon Wisselink Smarty 代码注入漏洞
The Smart template engine is one of the most famous PHP engines in the industry today. It provides an easy-to-manage way to separate business logic from presentation logic. A vulnerability has been reported in the Smart Template Engine, which allows an attacker to write to a cache file via the...
PT-2021-6791 · Smarty +2 · Smarty +2
Name of the Vulnerable Software and Affected Versions: Smarty versions prior to 3.1.39 Description: The issue is related to incorrect code generation handling when processing invalid function names in the Smarty template engine for PHP. This can allow a remote attacker to execute arbitrary code...
PT-2021-6792 · Smarty +2 · Smarty +2
Name of the Vulnerable Software and Affected Versions: Smarty versions prior to 3.1.39 Description: The issue allows a Sandbox Escape because the $smarty.template object can be accessed in sandbox mode. This is due to insufficient access control when handling the $smarty.template object...
Exploit for CVE-2021-26121
CS-Cart templates.manage Server Side Template Injection Remote...
CVE-2020-10375
An issue was discovered in New Media Smarty before 9.10. Passwords are stored in the database in an obfuscated format that can be easily reversed. The file data.mdb contains these obfuscated passwords in the second column. NOTE: this is unrelated to the popular Smarty template engine product...
CVE-2020-10375
An issue was discovered in New Media Smarty before 9.10. Passwords are stored in the database in an obfuscated format that can be easily reversed. The file data.mdb contains these obfuscated passwords in the second column. NOTE: this is unrelated to the popular Smarty template engine product...
CVE-2020-10375
An issue was discovered in New Media Smarty before 9.10. Passwords are stored in the database in an obfuscated format that can be easily reversed. The file data.mdb contains these obfuscated passwords in the second column. NOTE: this is unrelated to the popular Smarty template engine product...
CVE-2020-10375
CVE-2020-10375 affects New Media Smarty before 9.10. The issue is that passwords are stored in an obfuscated format that can be easily reversed, with the obfuscated values located in the file data.mdb (second column). This is explicitly noted as unrelated to the popular Smarty template engine pro...
Smarty Media New Media Smarty Security Breach
Smarty Media New Media Smarty is a software for demand management practices from Smarty Media, a German company This product is provided to anesthesiologists, psychotherapists, psychiatrists, neurologists and physicians who specialize in demand management practices. A security vulnerability exist...
phpGACL template multiple cross-site scripting vulnerabilities
Summary Multiple cross-site scripting vulnerabilities exist in the template functionality of phpGACL 3.3.7. A specially crafted HTTP request can lead to arbitrary JavaScript execution. An attacker can provide a crafted URL to trigger this vulnerability. Tested Versions phpGACL 3.3.7 OpenEMR 5.0.2...
Smarty_Internal_Runtime_TplFunction Sandbox Escape PHP Code Injection
More info at https://srcincite.io/blog/2021/02/18/smarty-template-engine-multiple-sandbox-escape-vulnerabilities.html...
template_object Sandbox Escape PHP Code Injection
More info at https://srcincite.io/blog/2021/02/18/smarty-template-engine-multiple-sandbox-escape-vulnerabilities.html...
SRC-2021-0009 : Smarty Template Engine template_object Sandbox Escape Remote Code Execution Vulnerability
Vulnerability Details: This vulnerability allows remote attackers execute arbitrary code on affected installations of Smarty Template Engine. Authentication is context dependant and may not be required to exploit this vulnerability. The specific flaw exists within the...
SRC-2021-0010 : Smarty Template Engine Smarty_Internal_Runtime_TplFunction Sandbox Escape Remote Code Execution Vulnerability
Vulnerability Details: This vulnerability allows remote attackers execute arbitrary code on affected installations of Smarty Template Engine. Authentication is context dependant and may not be required to exploit this vulnerability. The specific flaw exists within the SmartyInternalCompileFunctio...
CVE-2020-35625
An issue was discovered in the Widgets extension for MediaWiki through 1.35.1. Any user with the ability to edit pages within the Widgets namespace could call any static function within any class defined within PHP or MediaWiki via a crafted HTML comment, related to a Smarty template. For example...
MediaWiki 安全漏洞
MediaWiki is a set of free and freely available web-based Wiki engines from the MediaWiki Wikimedia Foundation in the United States. It can be used to deploy in-house knowledge management and content management systems. A security vulnerability exists in MediaWiki version 1.35.1 and earlier...
