CVE-2018-25047 Information

Description

In Smarty before 3.1.47 and 4.x before 4.2.1 libs/plugins/function.mailto.php allows XSS. A web page that uses smarty_function_mailto and that could be parameterized using GET or POST input parameters could allow injection of JavaScript code by a user.

Reference

https://github.com/smarty-php/smarty/releases/tag/v4.2.1 https://github.com/smarty-php/smarty/releases/tag/v3.1.47 https://bugs.gentoo.org/870100 https://github.com/smarty-php/smarty/issues/454