CVE-2026-50745
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
A missing sanitisation vulnerability exists with user input in the stats-video.php script. The way URLs to this script were constructed did not follow best practices, and the output of the Smarty custom helper function url was neither properly encoded nor sanitised, allowing user‑supplied input to be reflected without escaping.
Risk Assessment
The risk involves potential injection of malicious code (e.g., XSS) through reflected unsanitised user input, which could lead to session theft, redirects, or other attacks on end users.
Recommendation
Immediately update the stats-video.php script to properly encode and sanitise all user input and follow secure URL construction practices according to best practices.
Other vulnerabilities in Smarty
See all- CVE-2026-62992Medium
Smarty is a template engine for PHP. Prior to 5.8.2 (and 4.5.7 on the 4.x line), Security::_checkDir() does not fully resolve symbolic links before validating that a requested path lies within a configured secure directory. An attacker able to place or reference a symlink within a trusted directory could point outside the intended secure directory, bypassing the containment check and reading arbitrary files accessible to the PHP process. Fixed in versions 5.8.2 and 4.5.7.
- CVE-2014-8350High
Smarty before 3.1.21 allows remote attackers to bypass the secure mode restrictions and execute arbitrary PHP code, as demonstrated by "{literal}<{/literal}script language=php>" in a template.
- CVE-2026-62996Medium
Smarty is a template engine for PHP. From 5.0.0 until 5.8.4, Smarty's stream: resource-name handling does not adequately restrict which PHP stream wrappers and filter chains can be referenced from a template, allowing a php://filter-wrapped resource name to read arbitrary local files accessible to the PHP process. An attacker able to author or influence a template's resource reference could exploit this to disclose sensitive file contents. Fixed in version 5.8.4.
Original NVD description (English source)
A missing sanitisation vulnerability exists with user input in the stats-video.php script. The way URLs to this script were constructed did not follow best practices, and the output of the Smarty custom helper function url was neither properly encoded nor sanitised, allowing user‑supplied input to be reflected without escaping.