Unscored severity · published Feb 3, 2011
CVE-2010-4724
Multiple unspecified vulnerabilities in the parser implementation in Smarty before 3.0.0 RC3 have unknown impact and remote attack vectors
–
CVSS
1.9%
EPSS
No
On KEV
Description
Multiple unspecified vulnerabilities in the parser implementation in Smarty before 3.0.0 RC3 have unknown impact and remote attack vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.9% · higher than 79% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SM
Smarty · Smarty
through 3.0.0; 1.0; 1.0a; 1.0b; 1.1.0; 1.2.0; +34 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2010-4724
CVE.org
https://www.cve.org/CVERecord?id=CVE-2010-4724
smarty-php.googlecode.com
http://smarty-php.googlecode.com/svn/trunk/distribution/change_log.txt
More from Smarty
9.8
CVE-2021-26120
Smarty before 3.1.39 allows code injection via an unexpected function name after a {function name= substring
9.8
CVE-2011-1028
The $smarty.template variable in Smarty3 allows attackers to possibly execute arbitrary PHP code via the sysplugins/smarty_internal_compile_private_special_variable.php file
9.8
CVE-2017-1000480
Smarty 3 before 3.1.32 is vulnerable to a PHP code injection when calling fetch() or display() functions on custom resources that does not sanitize template name
9.8
CVE-2006-7105
PHP remote file inclusion vulnerability in libs/Smarty.class.php in Smarty 2.6.9 allows remote attackers to execute arbitrary PHP code via a URL in the filename parameter
8.8
CVE-2022-29221
Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic