Known vulnerabilities in Smarty

Software: Smarty
Software CPE: cpe:2.3:a:smarty_php_net:smarty:*:*:*:*:*:*:*:*
Website:
Total vulnerabilities: 24
Public exploits: 3
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Smarty Smarty is affected by 24 known vulnerabilities: 11 high, 7 medium, 6 low Critical High Medium Low

Vulnerabilities (24)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU138908 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-62996
CWE-22 Low
No
No
5.8.4 21.07.2026 SB2026072185
#VU138907 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-62992
CWE-22 Low
No
No
4.5.7, 5.8.2 21.07.2026 SB2026072184
#VU138906 - Server-Side Request Forgery (SSRF)
CVE-2026-62993
CWE-918 Low
No
No
4.5.7, 5.8.2 21.07.2026 SB2026072184
#VU89862 - Improper Control of Generation of Code ('Code Injection')
CVE-2024-35226
CWE-94 High
No
No
4.5.3, 5.2.0 29.05.2024 SB2024052913
SB20241210108
SB2024121303
and 3 more
#VU74151 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2023-28447
CWE-79 Low
No
No
3.1.48, 4.3.1 29.03.2023 SB2023032901
SB20230818172
SB20230818173
and 7 more
#VU67636 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2018-25047
CWE-79 Medium
No
No
3.1.47, 4.2.1 26.09.2022 SB2022092607
SB2022092631
SB2024121303
#VU63344 - Improper Control of Generation of Code ('Code Injection')
CVE-2022-29221
CWE-94 High
Available
No
3.1.45, 4.1.1 17.05.2022 SB2022051727
SB2022053020
SB2022092631
and 5 more
#VU61665 - Improper Control of Generation of Code ('Code Injection')
CVE-2021-21408
CWE-94 Medium
No
No
3.1.43, 4.0.3 28.03.2022 SB2022032834
SB2022032835
SB2022053020
and 4 more
#VU61664 - Improper Control of Generation of Code ('Code Injection')
CVE-2021-29454
CWE-94 High
No
No
3.1.42, 4.0.2 28.03.2022 SB2022032833
SB2022032835
SB2022053020
and 4 more
#VU50870 - Improper Control of Generation of Code ('Code Injection')
CVE-2021-26120
CWE-94 Medium
Available
No
3.1.39 23.02.2021 SB2021022311
SB2021052605
SB2022032835
and 4 more
#VU50869 - Permissions, Privileges, and Access Controls
CVE-2021-26119
CWE-264 Medium
Available
No
3.1.39 23.02.2021 SB2021022311
SB2021052605
SB2022032835
and 4 more
#VU30595 - Improper input validation
CVE-2011-1028
CWE-20 High
No
No
3.0.7 20.11.2019 SB2019112027
#VU41180 - Improper Control of Generation of Code ('Code Injection')
CVE-2014-8350
CWE-94 Medium
No
No
- 03.11.2014 SB2014110304
SB2014102312
SB2014102313
#VU43453 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2012-4437
CWE-79 Low
No
No
3.1.12 01.10.2012 SB2012100122
SB2013031103
#VU43732 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2012-4277
CWE-79 Low
No
No
3.1.8 14.08.2012 SB2012081406
#VU45377 - Improper input validation
CVE-2010-4725
CWE-20 High
No
No
- 03.02.2011 SB2011020302
#VU45378 - Improper input validation
CVE-2010-4726
CWE-20 High
No
No
- 03.02.2011 SB2011020302
#VU45383 - Improper input validation
CVE-2010-4722
CWE-20 High
No
No
- 03.02.2011 SB2011020302
#VU45384 - Permissions, Privileges, and Access Controls
CVE-2010-4723
CWE-264 High
No
No
- 03.02.2011 SB2011020302
#VU45385 - Improper input validation
CVE-2010-4724
CWE-20 High
No
No
- 03.02.2011 SB2011020302


Showing elements 1 - 20 out of 24