Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
smarty vulnerabilities and exploits
(subscribe to this query)
4.6
CVSSv2
CVE-2017-1000454
CMS Made Simple 2.1.6, 2.2, 2.2.1 are vulnerable to Smarty Template Injection in some core components, resulting in local file read prior to 2.2, and local file inclusion since 2.2.1
Cmsmadesimple Cms Made Simple
7.5
CVSSv2
CVE-2017-1000453
CMS Made Simple version 2.1.6 and 2.2 are vulnerable to Smarty templating injection in some core modules, resulting in unauthenticated PHP code execution.
Cmsmadesimple Cms Made Simple
3.5
CVSSv2
CVE-2014-8677
The installation process for SOPlanning 1.32 and previous versions allows remote authenticated users with a prepared database, and access to an existing database with a crafted name, or permissions to create arbitrary databases, or if PHP prior to 5.2 is being used, the configura...
Soplanning Soplanning
1 EDB exploit
4.3
CVSSv2
CVE-2017-9332
The smarty_self function in modules/module_smarty.php in PivotX 2.3.11 mishandles the URI, allowing XSS via vectors involving quotes in the self Smarty tag.
Pivotx Pivotx 2.3.11
2.6
CVSSv2
CVE-2016-2784
CMS Made Simple 2.x prior to 2.1.3 and 1.x prior to 1.12.2, when Smarty Cache is activated, allow remote malicious users to conduct cache poisoning attacks, modify links, and conduct cross-site scripting (XSS) attacks via a crafted HTTP Host header in a request.
Cmsmadesimple Cms Made Simple 2.1.1
Cmsmadesimple Cms Made Simple 2.1
Cmsmadesimple Cms Made Simple 1.11.11
Cmsmadesimple Cms Made Simple 1.11.10
Cmsmadesimple Cms Made Simple 1.11.3
Cmsmadesimple Cms Made Simple 1.11.2.1
Cmsmadesimple Cms Made Simple 1.10
Cmsmadesimple Cms Made Simple 1.9.4.3
Cmsmadesimple Cms Made Simple 1.9.4.2
Cmsmadesimple Cms Made Simple 1.6.10
Cmsmadesimple Cms Made Simple 1.6.9
Cmsmadesimple Cms Made Simple 1.6.7
Cmsmadesimple Cms Made Simple 1.6.6
Cmsmadesimple Cms Made Simple 1.5.3
Cmsmadesimple Cms Made Simple 1.5.2
Cmsmadesimple Cms Made Simple 1.2.5
Cmsmadesimple Cms Made Simple 1.2.4
Cmsmadesimple Cms Made Simple 1.1.2
Cmsmadesimple Cms Made Simple 1.1.1
Cmsmadesimple Cms Made Simple 1.0.2
Cmsmadesimple Cms Made Simple 1.0.1
Cmsmadesimple Cms Made Simple 1.12.1
1 EDB exploit
7.5
CVSSv2
CVE-2014-9178
Multiple SQL injection vulnerabilities in classes/ajax.php in the Smarty Pants Plugins SP Project & Document Manager plugin (sp-client-document-manager) 2.4.1 and previous versions for WordPress allow remote malicious users to execute arbitrary SQL commands via the (1) vendor...
Smartypantsplugins Sp Project \\& Document Manager
1 EDB exploit
7.5
CVSSv2
CVE-2014-8350
Smarty prior to 3.1.21 allows remote malicious users to bypass the secure mode restrictions and execute arbitrary PHP code as demonstrated by "{literal}<{/literal}script language=php>" in a template.
Smarty Smarty 3.1.16
Smarty Smarty 3.1.15
Smarty Smarty 3.1.6
Smarty Smarty 3.1.5
Smarty Smarty 3.1.19
Smarty Smarty 3.1.18
Smarty Smarty 3.1.17
Smarty Smarty 3.1.8
Smarty Smarty 3.1.7
Smarty Smarty 3.1.10
Smarty Smarty 3.1.1
Smarty Smarty 3.0.2
Smarty Smarty 3.0.1
Smarty Smarty 3.0.0
Smarty Smarty 2.6.4
Smarty Smarty 2.6.3
Smarty Smarty 2.6.17
Smarty Smarty 2.6.16
Smarty Smarty 2.6.1
Smarty Smarty 2.6.0
Smarty Smarty 2.4.2
Smarty Smarty 2.4.1
4.3
CVSSv2
CVE-2012-4437
Cross-site scripting (XSS) vulnerability in the SmartyException class in Smarty (aka smarty-php) prior to 3.1.12 allows remote malicious users to inject arbitrary web script or HTML via unspecified vectors that trigger a Smarty exception.
Smarty Smarty 2.6.10
Smarty Smarty 2.6.17
Smarty Smarty 2.6.7
Smarty Smarty 3.1.1
Smarty Smarty 2.6.13
Smarty Smarty 2.6.0
Smarty Smarty 2.6.11
Smarty Smarty 1.5.1
Smarty Smarty 2.4.1
Smarty Smarty 2.4.0
Smarty Smarty 2.6.25
Smarty Smarty 1.0
Smarty Smarty 3.1.8
Smarty Smarty 2.6.18
Smarty Smarty 3.0.0
Smarty Smarty 1.4.3
Smarty Smarty 1.4.4
Smarty Smarty 3.0.1
Smarty Smarty 1.1.0
Smarty Smarty 1.2.1
Smarty Smarty 3.1.3
Smarty Smarty 3.1.2
4.3
CVSSv2
CVE-2012-4277
Cross-site scripting (XSS) vulnerability in the smarty_function_html_options_optoutput function in distribution/libs/plugins/function.html_options.php in Smarty prior to 3.1.8 allows remote malicious users to inject arbitrary web script or HTML via unspecified vectors.
Smarty Smarty
Smarty Smarty 3.1.0
Smarty Smarty 3.0.4
Smarty Smarty 3.0.5
Smarty Smarty 3.0.6
Smarty Smarty 3.0.0
Smarty Smarty 3.0.1
Smarty Smarty 2.6.9
Smarty Smarty 2.6.4
Smarty Smarty 2.6.13
Smarty Smarty 2.6.0
Smarty Smarty 2.0.1
Smarty Smarty 2.2.0
Smarty Smarty 2.3.1
Smarty Smarty 2.6.18
Smarty Smarty 1.5.0
Smarty Smarty 1.5.2
Smarty Smarty 1.4.4
Smarty Smarty 1.4.0
Smarty Smarty 1.3.2
Smarty Smarty 1.1.0
Smarty Smarty 3.1.5
7.5
CVSSv2
CVE-2011-5061
functions.php in WHMCompleteSolution (WHMCS) 4.0.x up to and including 5.0.x allows remote malicious users to trigger arbitrary code execution in the Smarty templating system by submitting a crafted ticket, related to improper handling of characters in the subject field.
Whmcs Whmcompletesolution 4.3.1
Whmcs Whmcompletesolution 4.1.2
Whmcs Whmcompletesolution 4.2.0
Whmcs Whmcompletesolution 4.2.1
Whmcs Whmcompletesolution 5.0.3
Whmcs Whmcompletesolution 5.0.2
Whmcs Whmcompletesolution 5.0.1
Whmcs Whmcompletesolution 5.0.0
Whmcs Whmcompletesolution 4.3.0
Whmcs Whmcompletesolution 4.0.2
Whmcs Whmcompletesolution 4.4.2
Whmcs Whmcompletesolution 4.4.0
Whmcs Whmcompletesolution 4.1.1
Whmcs Whmcompletesolution 4.0.0
Whmcs Whmcompletesolution 4.5.2
Whmcs Whmcompletesolution 4.5.1
Whmcs Whmcompletesolution 4.0.1
Whmcs Whmcompletesolution 4.1.0
Whmcs Whmcompletesolution 4.5.0
Whmcs Whmcompletesolution 4.4.1
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
blind SQL injection
SSRF
buffer overflow
CVE-2023-28952
CVE-2023-41822
CVE-2024-27956
CVE-2023-7028
CVE-2024-34447
CVE-2024-34460
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
4
5
6
7
NEXT »