Lucene search
Veracode Vulnerability DatabaseVERACODE:37050HistorySep 16, 2022 - 5:57 a.m.
Cross-site Scripting (XSS)
2022-09-1605:57:40
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
20
cross-site scripting
smarty
function.mailto.php
vulnerability
javascript injection
EPSS
0.002
Percentile
54.2%
smarty/smarty is vulnerable to cross-site scripting. The vulnerability exists because the smarty_function_mailto function of function.mailto.php does not properly escape the GET and POST input parameters, allowing an attacker to inject and execute malicious javascript.
References
bugs.gentoo.org/870100
github.com/advisories/GHSA-hwq7-5vv9-c6cf
github.com/smarty-php/smarty/commit/55ea25d1f50f0406fb1ccedd212c527977793fc9
github.com/smarty-php/smarty/commit/f1f7ee6e34c14a8a9dfa5c6ef894d39277a93938
github.com/smarty-php/smarty/issues/454
github.com/smarty-php/smarty/releases/tag/v3.1.47
github.com/smarty-php/smarty/releases/tag/v4.2.1
lists.debian.org/debian-lts-announce/2023/01/msg00002.html
security.gentoo.org/glsa/202209-09
Related
ubuntucve
ubuntucve
CVE-2018-25047
2022-09-15 00:00:00
debiancve
debiancve
CVE-2018-25047
2022-09-15 00:15:09
prion
prion
Design/Logic Flaw
2022-09-15 00:15:00
openvas
openvas
Debian: Security Advisory (DLA-3262-1)
2023-01-06 00:00:00
Mageia: Security Advisory (MGASA-2023-0014)
2023-03-28 00:00:00
nessus
nessus
Debian DLA-3262-1 : smarty3 - LTS security update
2023-01-07 00:00:00
GLSA-202209-09 : Smarty: Multiple vulnerabilities
2022-09-25 00:00:00
friendsofphp
friendsofphp
smarty_function_mailto - JavaScript injection in eval function
2022-09-14 11:32:14
cve
cve
CVE-2018-25047
2022-09-15 00:15:09
nvd
nvd
CVE-2018-25047
2022-09-15 00:15:09
debian
debian
[SECURITY] [DLA 3262-1] smarty3 security update
2023-01-05 21:00:54
cvelist
cvelist
CVE-2018-25047
2022-09-14 00:00:00
mageia
mageia
Updated php-smarty packages fix security vulnerability
2023-01-24 10:58:24
osv
osv
smarty3 - security update
2023-01-05 00:00:00
Smarty Cross-site Scripting vulnerability in pages that use smarty_function_mailto
2022-09-16 00:00:39
CVE-2018-25047
2022-09-15 00:15:09
github
github
gentoo
gentoo
Smarty: Multiple vulnerabilities
2022-09-25 00:00:00