Total
31 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2010-4722 | 1 Smarty | 1 Smarty | 2024-11-21 | 10.0 HIGH | N/A |
| Unspecified vulnerability in the fetch plugin in Smarty before 3.0.2 has unknown impact and remote attack vectors. | |||||
| CVE-2009-5054 | 1 Smarty | 1 Smarty | 2024-11-21 | 7.5 HIGH | N/A |
| Smarty before 3.0.0 beta 4 does not consider the umask value when setting the permissions of files, which might allow attackers to bypass intended access restrictions via standard filesystem operations. | |||||
| CVE-2009-5053 | 1 Smarty | 1 Smarty | 2024-11-21 | 7.5 HIGH | N/A |
| Unspecified vulnerability in Smarty before 3.0.0 beta 6 allows remote attackers to execute arbitrary PHP code by injecting this code into a cache file. | |||||
| CVE-2009-5052 | 1 Smarty | 1 Smarty | 2024-11-21 | 10.0 HIGH | N/A |
| Multiple unspecified vulnerabilities in Smarty before 3.0.0 beta 6 have unknown impact and attack vectors. | |||||
| CVE-2009-1669 | 1 Smarty | 1 Smarty | 2024-11-21 | 10.0 HIGH | N/A |
| The smarty_function_math function in libs/plugins/function.math.php in Smarty 2.6.22 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in the equation attribute of the math function. NOTE: some of these details are obtained from third party information. | |||||
| CVE-2008-4811 | 1 Smarty | 1 Smarty | 2024-11-21 | 7.5 HIGH | N/A |
| The _expand_quoted_text function in libs/Smarty_Compiler.class.php in Smarty 2.6.20 r2797 and earlier allows remote attackers to execute arbitrary PHP code via vectors related to templates and a \ (backslash) before a dollar-sign character. | |||||
| CVE-2008-4810 | 1 Smarty | 1 Smarty | 2024-11-21 | 7.5 HIGH | N/A |
| The _expand_quoted_text function in libs/Smarty_Compiler.class.php in Smarty 2.6.20 before r2797 allows remote attackers to execute arbitrary PHP code via vectors related to templates and (1) a dollar-sign character, aka "php executed in templates;" and (2) a double quoted literal string, aka a "function injection security hole." NOTE: each vector affects slightly different SVN revisions. | |||||
| CVE-2008-1066 | 1 Smarty | 1 Smarty | 2024-11-21 | 7.5 HIGH | N/A |
| The modifier.regex_replace.php plugin in Smarty before 2.6.19, as used by Serendipity (S9Y) and other products, allows attackers to call arbitrary PHP functions via templates, related to a '\0' character in a search string. | |||||
| CVE-2006-7193 | 1 Smarty | 1 Smarty | 2024-11-21 | 7.5 HIGH | N/A |
| PHP remote file inclusion vulnerability in unit_test/test_cases.php in Smarty 2.6.1 allows remote attackers to execute arbitrary PHP code via a URL in the SMARTY_DIR parameter. NOTE: this issue is disputed by CVE and a third party because SMARTY_DIR is a constant | |||||
| CVE-2006-7105 | 1 Smarty | 1 Smarty | 2024-11-21 | 7.5 HIGH | N/A |
| PHP remote file inclusion vulnerability in libs/Smarty.class.php in Smarty 2.6.9 allows remote attackers to execute arbitrary PHP code via a URL in the filename parameter. NOTE: in the original disclosure, filename is used in a function definition, so this report is probably incorrect | |||||
| CVE-2005-0913 | 1 Smarty | 1 Smarty | 2024-11-20 | 7.5 HIGH | N/A |
| Unknown vulnerability in the regex_replace modifier (modifier.regex_replace.php) in Smarty before 2.6.8 allows attackers to execute arbitrary PHP code. | |||||