Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
smarty vulnerabilities and exploits
(subscribe to this query)
5.3
CVSSv3
CVE-2014-8939
Lexiglot through 2014-11-20 allows remote malicious users to obtain sensitive information (full path) via an include/smarty/plugins/modifier.date_format.php request if PHP has a non-recommended configuration that produces warning messages.
Piwigo Lexiglot
5.3
CVSSv3
CVE-2018-20566
An issue exists in DouCo DouPHP 1.5 20181221. It allows full path disclosure in "Smarty error: unable to read resource" error messages for a crafted installation page.
Douco Douphp 1.5
5.3
CVSSv3
CVE-2014-8677
The installation process for SOPlanning 1.32 and previous versions allows remote authenticated users with a prepared database, and access to an existing database with a crafted name, or permissions to create arbitrary databases, or if PHP prior to 5.2 is being used, the configura...
Soplanning Soplanning
1 EDB exploit
4.8
CVSSv3
CVE-2023-41661
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PressPage Entertainment Inc. Smarty for WordPress plugin <= 3.1.35 versions.
Smarty Smarty
4.8
CVSSv3
CVE-2004-1865
Cross-site scripting (XSS) vulnerability in the administration panel in bBlog 0.7.2 allows remote authenticated users with superuser privileges to inject arbitrary web script or HTML via a blog name ($blogname). NOTE: if administrators are normally allowed to add HTML by other me...
Bblog Bblog 0.7.2
4.7
CVSSv3
CVE-2016-2784
CMS Made Simple 2.x prior to 2.1.3 and 1.x prior to 1.12.2, when Smarty Cache is activated, allow remote malicious users to conduct cache poisoning attacks, modify links, and conduct cross-site scripting (XSS) attacks via a crafted HTTP Host header in a request.
Cmsmadesimple Cms Made Simple 2.1.1
Cmsmadesimple Cms Made Simple 2.1
Cmsmadesimple Cms Made Simple 1.11.11
Cmsmadesimple Cms Made Simple 1.11.10
Cmsmadesimple Cms Made Simple 1.11.3
Cmsmadesimple Cms Made Simple 1.11.2.1
Cmsmadesimple Cms Made Simple 1.10
Cmsmadesimple Cms Made Simple 1.9.4.3
Cmsmadesimple Cms Made Simple 1.9.4.2
Cmsmadesimple Cms Made Simple 1.6.10
Cmsmadesimple Cms Made Simple 1.6.9
Cmsmadesimple Cms Made Simple 1.6.7
Cmsmadesimple Cms Made Simple 1.6.6
Cmsmadesimple Cms Made Simple 1.5.3
Cmsmadesimple Cms Made Simple 1.5.2
Cmsmadesimple Cms Made Simple 1.2.5
Cmsmadesimple Cms Made Simple 1.2.4
Cmsmadesimple Cms Made Simple 1.1.2
Cmsmadesimple Cms Made Simple 1.1.1
Cmsmadesimple Cms Made Simple 1.0.2
Cmsmadesimple Cms Made Simple 1.0.1
Cmsmadesimple Cms Made Simple 1.12.1
1 EDB exploit
NA
CVE-2014-9178
Multiple SQL injection vulnerabilities in classes/ajax.php in the Smarty Pants Plugins SP Project & Document Manager plugin (sp-client-document-manager) 2.4.1 and previous versions for WordPress allow remote malicious users to execute arbitrary SQL commands via the (1) vendor...
Smartypantsplugins Sp Project \\& Document Manager
1 EDB exploit
NA
CVE-2014-8350
Smarty prior to 3.1.21 allows remote malicious users to bypass the secure mode restrictions and execute arbitrary PHP code as demonstrated by "{literal}<{/literal}script language=php>" in a template.
Smarty Smarty 3.1.16
Smarty Smarty 3.1.15
Smarty Smarty 3.1.6
Smarty Smarty 3.1.5
Smarty Smarty 3.1.19
Smarty Smarty 3.1.18
Smarty Smarty 3.1.17
Smarty Smarty 3.1.8
Smarty Smarty 3.1.7
Smarty Smarty 3.1.10
Smarty Smarty 3.1.1
Smarty Smarty 3.0.2
Smarty Smarty 3.0.1
Smarty Smarty 3.0.0
Smarty Smarty 2.6.4
Smarty Smarty 2.6.3
Smarty Smarty 2.6.17
Smarty Smarty 2.6.16
Smarty Smarty 2.6.1
Smarty Smarty 2.6.0
Smarty Smarty 2.4.2
Smarty Smarty 2.4.1
NA
CVE-2012-4437
Cross-site scripting (XSS) vulnerability in the SmartyException class in Smarty (aka smarty-php) prior to 3.1.12 allows remote malicious users to inject arbitrary web script or HTML via unspecified vectors that trigger a Smarty exception.
Smarty Smarty 2.6.10
Smarty Smarty 2.6.17
Smarty Smarty 2.6.7
Smarty Smarty 3.1.1
Smarty Smarty 2.6.13
Smarty Smarty 2.6.0
Smarty Smarty 2.6.11
Smarty Smarty 1.5.1
Smarty Smarty 2.4.1
Smarty Smarty 2.4.0
Smarty Smarty 2.6.25
Smarty Smarty 1.0
Smarty Smarty 3.1.8
Smarty Smarty 2.6.18
Smarty Smarty 3.0.0
Smarty Smarty 1.4.3
Smarty Smarty 1.4.4
Smarty Smarty 3.0.1
Smarty Smarty 1.1.0
Smarty Smarty 1.2.1
Smarty Smarty 3.1.3
Smarty Smarty 3.1.2
NA
CVE-2012-4277
Cross-site scripting (XSS) vulnerability in the smarty_function_html_options_optoutput function in distribution/libs/plugins/function.html_options.php in Smarty prior to 3.1.8 allows remote malicious users to inject arbitrary web script or HTML via unspecified vectors.
Smarty Smarty
Smarty Smarty 3.1.0
Smarty Smarty 3.0.4
Smarty Smarty 3.0.5
Smarty Smarty 3.0.6
Smarty Smarty 3.0.0
Smarty Smarty 3.0.1
Smarty Smarty 2.6.9
Smarty Smarty 2.6.4
Smarty Smarty 2.6.13
Smarty Smarty 2.6.0
Smarty Smarty 2.0.1
Smarty Smarty 2.2.0
Smarty Smarty 2.3.1
Smarty Smarty 2.6.18
Smarty Smarty 1.5.0
Smarty Smarty 1.5.2
Smarty Smarty 1.4.4
Smarty Smarty 1.4.0
Smarty Smarty 1.3.2
Smarty Smarty 1.1.0
Smarty Smarty 3.1.5
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-29895
blind SQL injection
CVE-2024-5064
CVE-2023-52677
CVE-2023-52682
CVE-2024-30051
CVE-2024-35849
remote attackers
remote
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
4
5
6
7
NEXT »