smarty/smarty Security Advisories for v3.1.43 (4)
-
[HIGH] Smarty vulnerable to PHP Code Injection by malicious attribute in extends-tag
PKSA-5rsx-p2fk-h2gr CVE-2024-35226 GHSA-4rmg-292m-wg3w
Affected version: >=3.0.0,<4.5.3|>=5.0.0,<5.1.1
Reported by:
GitHub -
[HIGH] Cross site scripting vulnerability in Javascript escaping
PKSA-2q9d-8kh9-49wx CVE-2023-28447 GHSA-7j98-h7fp-4vwj
Affected version: <3.1.48|>=4.0.0,<4.1.1
Reported by:
GitHub, FriendsOfPHP/security-advisories -
[MEDIUM] smarty_function_mailto - JavaScript injection in eval function
PKSA-pght-23ww-rrdy CVE-2018-25047 GHSA-hwq7-5vv9-c6cf
Affected version: <3.1.47|>=4.0.0,<4.2.1
Reported by:
GitHub, FriendsOfPHP/security-advisories -
[HIGH] PHP Code Injection by malicious block or filename
PKSA-6y8p-nrf4-ysf5 CVE-2022-29221 GHSA-634x-pc3q-cf4c
Affected version: <3.1.45|>=4.0.0,<4.1.1
Reported by:
GitHub, FriendsOfPHP/security-advisories