CVE-2025-46661

—

CVSS 3.1

9.8 critical

EPSS

<1%p53

Published

Apr 28, 2025 (Apr 28, 2025)

Modified

Jun 17, 2026

Description

IPW Systems Metazo through 8.1.3 allows unauthenticated Remote Code Execution because smartyValidator.php enables the attacker to provide template expressions, aka Server-Side Template-Injection. All instances have been patched by the Supplier.

Vendors: ipwsystems
Products: metazo
Weakness: CWE-1336, CWE-94
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.8%)

In the news0 stories

No ingested article mentions this CVE yet.