https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-29T03:53:26.192377+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2023-28447 CVE-2023-28447 — Cross site scripting vulnerability in Javascript escaping in smarty/smarty 2026-09-29T03:53:26.200137+00:00

Affected: smarty-php smarty

Smarty is a template engine for PHP. In affected versions smarty did not properly escape javascript code. An attacker could exploit this vulnerability to execute arbitrary JavaScript code in the context of the user's browser session. This may lead to unauthorized access to sensitive user data, manipulation of the web application's behavior, or unauthorized actions performed on behalf of the user. Users are advised to upgrade to either version 3.1.48 or to 4.3.1 to resolve this issue. There are no known workarounds for this vulnerability.

 https://vulnerability.circl.lu/vuln/usn-6550-1 USN-6550-1 — postfixadmin vulnerabilities 2026-09-29T03:53:26.200261+00:00

Affected: Ubuntu:Pro:18.04:LTS: postfixadmin, Ubuntu:Pro:20.04:LTS: postfixadmin, Ubuntu:Pro:22.04:LTS: postfixadmin

It was discovered that Smarty, that is integrated in the PostfixAdmin code, was not properly sanitizing user input when generating templates. An attacker could, through PHP injection, possibly use this issue to execute arbitrary code. (CVE-2022-29221)

It was discovered that Moment.js, that is integrated in the PostfixAdmin code, was using an inefficient parsing algorithm when processing date strings in the RFC 2822 standard. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-31129)

It was discovered that Smarty, that is integrated in the PostfixAdmin code, was not properly escaping JavaScript code. An attacker could possibly use this issue to conduct cross-site scripting attacks (XSS). (CVE-2023-28447)