Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
349 results · page 4 of 7
Sep 21, 2023SQL injection vulnerability in updatepos.php in PrestaShop opartfaq through 1.0.3 allows remote attackers to run arbitrary SQL commands via unspedified vector.CVE-2023-34576 · Other software · Store-opart · reported by MITRECritical 9.8
SQL injection vulnerability in updatepos.php in PrestaShop opartfaq through 1.0.3 allows remote attackers to run arbitrary SQL commands via unspedified vector.
- Product
- Op'art Product FAQ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.friendsofpresta.orgsecurity.friendsofpresta.org
Sep 21, 2023SQL injection vulnerability in Prestashop opartplannedpopup 1.4.11 and earlier allows remote attackers to run arbitrary SQL commands via OpartPlannedPopupModuleCVE-2023-34577 · Other software · Planned Popup Project · reported by MITRECritical 9.8
SQL injection vulnerability in Prestashop opartplannedpopup 1.4.11 and earlier allows remote attackers to run arbitrary SQL commands via OpartPlannedPopupModuleFrontController::prepareHook() method.
- Product
- Planned Popup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.friendsofpresta.orgsecurity.friendsofpresta.org
Sep 20, 2023SimpleImportProduct Prestashop Module v6.2.9 was discovered to contain a SQL injection vulnerability via the key parameter at send.php.CVE-2023-39675 · Other software · Myprestamodules · reported by MITRECritical 9.8
SimpleImportProduct Prestashop Module v6.2.9 was discovered to contain a SQL injection vulnerability via the key parameter at send.php.
- Product
- Product Catalog (csv, Excel) Import
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.sorcery.iesorcery.ie
Sep 20, 2023SQL injection vulnerability in PrestaShop opartsavecart through 2.0.7 allows remote attackers to run arbitrary SQL commands via OpartSaveCartDefaultModuleFrontCCVE-2023-34575 · Other software · Store-opart · reported by MITRECritical 9.8
SQL injection vulnerability in PrestaShop opartsavecart through 2.0.7 allows remote attackers to run arbitrary SQL commands via OpartSaveCartDefaultModuleFrontController::initContent() and OpartSaveCartDefaultModuleFrontController::displayAjaxSendCartByEmail() methods.
- Product
- Op'art Save Cart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.friendsofpresta.orgsecurity.friendsofpresta.org
Sep 20, 2023MyPrestaModules Prestashop Module v6.2.9 and UpdateProducts Prestashop Module v3.6.9 were discovered to contain a PHPInfo information disclosure vulnerability vCVE-2023-39677 · Other software · Myprestamodules · reported by MITREHigh 7.5
MyPrestaModules Prestashop Module v6.2.9 and UpdateProducts Prestashop Module v3.6.9 were discovered to contain a PHPInfo information disclosure vulnerability via send.php.
- Product
- Product Catalog (csv, Excel) Import
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.sorcery.iemyprestamodules.com
Sep 20, 2023M4 PDF plugin for Prestashop sites, in its 3.2.3 version and before, is vulnerable to an arbitrary HTML Document crafting vulnerability.CVE-2022-45448 · Websites & servers · Prestashop · reported by cve-coordination@incibe.esLow 3.5
M4 PDF plugin for Prestashop sites, in its 3.2.3 version and before, is vulnerable to an arbitrary HTML Document crafting vulnerability. The resource /m4pdf/pdf.php uses templates to dynamically create documents. In the case that the template does not exist, the application will return a fixed document with a message in mpdf format. An attacker could exploit this vulnerability by inputting a valid HTML/CSS document as the value of the parameter.
- Product
- M4 PDF plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2023M4 PDF plugin for Prestashop sites, in its 3.2.3 version and before, is vulnerable to a directory traversal vulnerability.CVE-2022-45447 · Websites & servers · Prestashop · reported by cve-coordination@incibe.esMedium 6.5
M4 PDF plugin for Prestashop sites, in its 3.2.3 version and before, is vulnerable to a directory traversal vulnerability. The “f” parameter is not properly checked in the resource /m4pdf/pdf.php, returning any file given its relative path. An attacker that exploits this vulnerability could download /etc/passwd from the server if the file exists.
- Product
- M4 PDF plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2023FieldPopupNewsletter Prestashop Module v1.0.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the callback parameter at ajax.CVE-2023-39676 · Other software · Fieldthemes · reported by MITREMedium 6.1
FieldPopupNewsletter Prestashop Module v1.0.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the callback parameter at ajax.php.
- Product
- Fieldpopupnewsletter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.sorcery.iesorcery.ie
Aug 16, 2023In the module “Customization fields fee for your store” (aicustomfee) from ai-dev module for PrestaShop, an attacker can perform SQL injection up to 0.2.0.CVE-2023-33663 · Other software · Ai-dev · reported by MITRECritical 9.8
In the module “Customization fields fee for your store” (aicustomfee) from ai-dev module for PrestaShop, an attacker can perform SQL injection up to 0.2.0. Release 0.2.1 fixed this security issue.
- Product
- Aicustomfee
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.friendsofpresta.orgboutique.ai-dev.fr
Aug 7, 2023PrestaShop is an open source e-commerce web application.CVE-2023-39530 · Websites & servers · PrestaShop · reported by GitHubMedium 6.5
PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, it is possible to delete files from the server via the CustomerMessage API. Version 8.1.1 contains a patch for this issue. There are no known workarounds.
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2023PrestaShop is an open source e-commerce web application.CVE-2023-39529 · Websites & servers · PrestaShop · reported by GitHubMedium 6.7
PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, it is possible to delete a file from the server by using the Attachments controller and the Attachments API. Version 8.1.1 contains a patch for this issue. There are no known workarounds.
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2023PrestaShop is an open source e-commerce web application.CVE-2023-39528 · Websites & servers · PrestaShop · reported by GitHubMedium 6.8
PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, the `displayAjaxEmailHTML` method can be used to read any file on the server, potentially even outside of the project if the server is not correctly configured. Version 8.1.1 contains a patch for this issue. There are no known workarounds.
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2023PrestaShop is an open source e-commerce web application.CVE-2023-39527 · Websites & servers · PrestaShop · reported by GitHubHigh 8.3
PrestaShop is an open source e-commerce web application. Versions prior to 1.7.8.10, 8.0.5, and 8.1.1 are vulnerable to cross-site scripting through the `isCleanHTML` method. Versions 1.7.8.10, 8.0.5, and 8.1.1 contain a patch. There are no known workarounds.
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2023PrestaShop is an open source e-commerce web application.CVE-2023-39526 · Websites & servers · PrestaShop · reported by GitHubCritical 9.1
PrestaShop is an open source e-commerce web application. Versions prior to 1.7.8.10, 8.0.5, and 8.1.1 are vulnerable to remote code execution through SQL injection and arbitrary file write in the back office. Versions 1.7.8.10, 8.0.5, and 8.1.1 contain a patch. There are no known workarounds.
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2023PrestaShop is an open source e-commerce web application.CVE-2023-39525 · Websites & servers · PrestaShop · reported by GitHubMedium 6.5
PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, in the back office, files can be compromised using path traversal by replaying the import file deletion query with a specified file path that uses the traversal path. Version 8.1.1 contains a patch for this issue. There are no known workarounds.
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2023PrestaShop is an open source e-commerce web application.CVE-2023-39524 · Websites & servers · PrestaShop · reported by GitHubMedium 6.7
PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, SQL injection possible in the product search field, in BO's product page. Version 8.1.1 contains a patch for this issue. There are no known workarounds.
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 1, 2023An Unrestricted Upload of File with Dangerous Type vulnerability in the Ajaxmanager File and Database explorer (ajaxmanager) module for PrestaShop through 2.3.0CVE-2023-33493 · Other software · Ajaxmanager Project · reported by MITRECritical 9.8
An Unrestricted Upload of File with Dangerous Type vulnerability in the Ajaxmanager File and Database explorer (ajaxmanager) module for PrestaShop through 2.3.0, allows remote attackers to upload dangerous files without restrictions.
- Product
- Ajaxmanager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.friendsofpresta.orgsecurity.friendsofpresta.org
Jul 26, 2023SQL injection vulnerability found in PrestaShop sendinblue v.4.0.15 and before allow a remote attacker to gain privileges via the ajaxOrderTracking.php componenCVE-2023-26859 · Other software · Brevo · reported by MITRECritical 9.8
SQL injection vulnerability found in PrestaShop sendinblue v.4.0.15 and before allow a remote attacker to gain privileges via the ajaxOrderTracking.php component.
- Product
- Brevo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaddons.prestashop.comsecurity.friendsofpresta.org
Jul 24, 2023An issue in /functions/fbaorder.php of Prestashop amazon before v5.2.24 allows attackers to execute a directory traversal attack.CVE-2023-33777 · Websites & servers · Prestashop · reported by MITREMedium 5.3
An issue in /functions/fbaorder.php of Prestashop amazon before v5.2.24 allows attackers to execute a directory traversal attack.
- Product
- Amazon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaddons.prestashop.comsecurity.friendsofpresta.org
Jul 20, 2023In the module “Image: WebP, Compress, Zoom, Lazy load, Alt & More” (ultimateimagetool) in versions up to 2.1.02 from Advanced Plugins for PrestaShop, a guest caCVE-2023-30200 · Other software · Advancedplugins · reported by MITREHigh 7.5
In the module “Image: WebP, Compress, Zoom, Lazy load, Alt & More” (ultimateimagetool) in versions up to 2.1.02 from Advanced Plugins for PrestaShop, a guest can download personal informations without restriction by performing a path traversal attack.
- Product
- Ultimateimagetool
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecurity.friendsofpresta.org
Jul 18, 2023An SQL injection vulnerability in the Payplug (payplug) module for PrestaShop, in versions 3.6.0, 3.6.1, 3.6.2, 3.6.3, 3.7.0 and 3.7.1, allows remote attackers CVE-2023-30153 · Websites & servers · Prestashop · reported by MITRECritical 9.8
An SQL injection vulnerability in the Payplug (payplug) module for PrestaShop, in versions 3.6.0, 3.6.1, 3.6.2, 3.6.3, 3.7.0 and 3.7.1, allows remote attackers to execute arbitrary SQL commands via the ajax.php front controller.
- Product
- Payplug
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaddons.prestashop.comsecurity.friendsofpresta.org
Jul 13, 2023A SQL injection vulnerability in the Boxtal (envoimoinscher) module for PrestaShop, after version 3.1.10, allows remote attackers to execute arbitrary SQL commaCVE-2023-30151 · Other software · Boxtal · reported by MITRECritical 9.8
A SQL injection vulnerability in the Boxtal (envoimoinscher) module for PrestaShop, after version 3.1.10, allows remote attackers to execute arbitrary SQL commands via the `key` GET parameter.
- Product
- Envoimoinscher
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaddons.prestashop.comhelp.boxtal.com
Jul 11, 2023SQL injection vulnerability found in PrestaShop vivawallet v.1.7.10 and before allows a remote attacker to gain privileges via the vivawallet() module.CVE-2023-26861 · Other software · Vivawallet · reported by MITRECritical 9.8
SQL injection vulnerability found in PrestaShop vivawallet v.1.7.10 and before allows a remote attacker to gain privileges via the vivawallet() module.
- Product
- Viva Wallet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaddons.prestashop.comgithub.com
Jul 7, 2023SQL injection vulnerability found in PrestaShop lekerawen_ocs before v.1.4.1 allow a remote attacker to gain privileges via the KerawenHelper::setCartOperationICVE-2023-27845 · Other software · Kerawen · reported by MITRECritical 9.8
SQL injection vulnerability found in PrestaShop lekerawen_ocs before v.1.4.1 allow a remote attacker to gain privileges via the KerawenHelper::setCartOperationInfo, and KerawenHelper::resetCheckoutSessionData components.
- Product
- Omnichannel Stocks
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkerawen.comsecurity.friendsofpresta.org
Jul 6, 2023In the module "Detailed Order" (lgdetailedorder) in version up to 1.1.20 from Linea Grafica for PrestaShop, a guest can download personal informations without rCVE-2023-30195 · Other software · Lineagrafica · reported by MITREHigh 7.5
In the module "Detailed Order" (lgdetailedorder) in version up to 1.1.20 from Linea Grafica for PrestaShop, a guest can download personal informations without restriction formatted in json.
- Product
- Lgdetailedorder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfriends-of-presta.github.iofriends-of-presta.github.io
Jun 15, 2023In the PrestaShop < 2.4.3 module "Length, weight or volume sell" (ailinear) there is a SQL injection vulnerability.CVE-2023-31672 · Other software · Ai-dev · reported by MITRECritical 9.8
In the PrestaShop < 2.4.3 module "Length, weight or volume sell" (ailinear) there is a SQL injection vulnerability.
- Product
- Ailinear
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfriends-of-presta.github.iofriends-of-presta.github.io
Jun 14, 2023PrestaShop leocustomajax 1.0 and 1.0.0 are vulnerable to SQL Injection via modules/leocustomajax/leoajax.php.CVE-2023-30150 · Other software · Leotheme · reported by MITRECritical 9.8
PrestaShop leocustomajax 1.0 and 1.0.0 are vulnerable to SQL Injection via modules/leocustomajax/leoajax.php.
- Product
- Leocustomajax
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfriends-of-presta.github.iofriends-of-presta.github.io
Jun 14, 2023PrestaShop postfinance <= 17.1.13 is vulnerable to SQL Injection via PostfinanceValidationModuleFrontController::postProcess().CVE-2023-31671 · Other software · Webbax · reported by MITRECritical 9.8
PrestaShop postfinance <= 17.1.13 is vulnerable to SQL Injection via PostfinanceValidationModuleFrontController::postProcess().
- Product
- Postfinance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfriends-of-presta.github.ioshop.webbax.ch
Jun 12, 2023Prestashop winbizpayment <= 1.0.2 is vulnerable to Incorrect Access Control via modules/winbizpayment/downloads/download.php.CVE-2023-30198 · Other software · Webbax · reported by MITREHigh 7.5
Prestashop winbizpayment <= 1.0.2 is vulnerable to Incorrect Access Control via modules/winbizpayment/downloads/download.php.
- Product
- Winbizpayment
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comfriends-of-presta.github.io
Jun 6, 2023PrestaShop jmspagebuilder 3.x is vulnerable to SQL Injection via ajax_jmspagebuilder.php.CVE-2023-29632 · Other software · Joommasters · reported by MITRECritical 9.8
PrestaShop jmspagebuilder 3.x is vulnerable to SQL Injection via ajax_jmspagebuilder.php.
- Product
- Jmspagebuilder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfriends-of-presta.github.iofriends-of-presta.github.io
Jun 5, 2023PrestaShop jmsslider 1.6.0 is vulnerable to Incorrect Access Control via ajax_jmsslider.php.CVE-2023-29631 · Other software · Joommasters · reported by MITRECritical 9.8
PrestaShop jmsslider 1.6.0 is vulnerable to Incorrect Access Control via ajax_jmsslider.php.
- Product
- JMS Slider
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfriends-of-presta.github.iofriends-of-presta.github.io
Jun 5, 2023PrestaShop jmsmegamenu 1.1.x and 2.0.x is vulnerable to SQL Injection via ajax_jmsmegamenu.php.CVE-2023-29630 · Other software · Joommasters · reported by MITRECritical 9.8
PrestaShop jmsmegamenu 1.1.x and 2.0.x is vulnerable to SQL Injection via ajax_jmsmegamenu.php.
- Product
- JMS Drop Mega Menu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfriends-of-presta.github.iofriends-of-presta.github.io
Jun 5, 2023PrestaShop jmsthemelayout 2.5.5 is vulnerable to SQL Injection via ajax_jmsvermegamenu.php.CVE-2023-29629 · Other software · Jmsthemelayout Project · reported by MITRECritical 9.8
PrestaShop jmsthemelayout 2.5.5 is vulnerable to SQL Injection via ajax_jmsvermegamenu.php.
- Product
- Jmsthemelayout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfriends-of-presta.github.iofriends-of-presta.github.io
Jun 2, 2023SQL injection vulnerability in the City Autocomplete (cityautocomplete) module from ebewe.net for PrestaShop, prior to version 1.8.12 (for PrestaShop version 1.CVE-2023-30149 · Other software · Ebewe · reported by MITRECritical 9.8
SQL injection vulnerability in the City Autocomplete (cityautocomplete) module from ebewe.net for PrestaShop, prior to version 1.8.12 (for PrestaShop version 1.5/1.6) or prior to 2.0.3 (for PrestaShop version 1.7), allows remote attackers to execute arbitrary SQL commands via the type, input_name. or q parameter in the autocompletion.php front controller.
- Product
- City Autocomplete
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaddons.prestashop.comfriends-of-presta.github.io
Jun 2, 2023Improper Limitation of a Pathname leads to a Path Traversal vulnerability in the module King-Avis for Prestashop, allowing a user knowing the download token to CVE-2023-3031 · Other software · Webbax · reported by vulnerability@ncsc.chMedium 4.9
Improper Limitation of a Pathname leads to a Path Traversal vulnerability in the module King-Avis for Prestashop, allowing a user knowing the download token to read arbitrary local files.This issue affects King-Avis: before 17.3.15.
- Product
- King-Avis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordborelenzo.github.ioborelenzo.github.io
Jun 1, 2023An issue was discovered in the tshirtecommerce (aka Custom Product Designer) component 2.1.4 for PrestaShop.CVE-2023-27640 · Other software · Tshirtecommerce · reported by MITREHigh 7.5
An issue was discovered in the tshirtecommerce (aka Custom Product Designer) component 2.1.4 for PrestaShop. An HTTP request can be forged with the POST parameter type in the /tshirtecommerce/fonts.php endpoint, to allow a remote attacker to traverse directories on the system in order to open files (without restriction on the extension and path). The content of the file is returned with base64 encoding. This is exploited in the wild in March 2023.
- Product
- Custom Product Designer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfriends-of-presta.github.iofriends-of-presta.github.io
Jun 1, 2023An issue was discovered in the tshirtecommerce (aka Custom Product Designer) component 2.1.4 for PrestaShop.CVE-2023-27639 · Other software · Tshirtecommerce · reported by MITREHigh 7.5
An issue was discovered in the tshirtecommerce (aka Custom Product Designer) component 2.1.4 for PrestaShop. An HTTP request can be forged with the POST parameter file_name in the tshirtecommerce/ajax.php?type=svg endpoint, to allow a remote attacker to traverse directories on the system in order to open files (without restriction on the extension and path). Only files that can be parsed in XML can be opened. This is exploited in the wild in March 2023.
- Product
- Custom Product Designer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfriends-of-presta.github.iofriends-of-presta.github.io
May 30, 2023Incorrect Access Control in the module "My inventory" (myinventory) <= 1.6.6 from Webbax for PrestaShop, allows a guest to download personal information withoutCVE-2023-30197 · Other software · Webbax · reported by MITREHigh 7.5
Incorrect Access Control in the module "My inventory" (myinventory) <= 1.6.6 from Webbax for PrestaShop, allows a guest to download personal information without restriction by performing a path traversal attack.
- Product
- Myinventory
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfriends-of-presta.github.iogithub.com
May 30, 2023Prestashop salesbooster <= 1.10.4 is vulnerable to Incorrect Access Control via modules/salesbooster/downloads/download.php.CVE-2023-30196 · Other software · Webbax · reported by MITREHigh 7.5
Prestashop salesbooster <= 1.10.4 is vulnerable to Incorrect Access Control via modules/salesbooster/downloads/download.php.
- Product
- Salesbooster
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfriends-of-presta.github.iogithub.com
May 25, 2023In the Store Commander scquickaccounting module for PrestaShop through 3.7.3, multiple sensitive SQL calls can be executed with a trivial HTTP request and exploCVE-2023-33280 · Other software · Storecommander · reported by MITRECritical 9.8
In the Store Commander scquickaccounting module for PrestaShop through 3.7.3, multiple sensitive SQL calls can be executed with a trivial HTTP request and exploited to forge a blind SQL injection.
- Product
- Quickaccounting
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfriends-of-presta.github.iostorecommander.com
May 25, 2023In the Store Commander scfixmyprestashop module through 2023-05-09 for PrestaShop, sensitive SQL calls can be executed with a trivial HTTP request and exploitedCVE-2023-33279 · Other software · Scfixmyprestashop Project · reported by MITRECritical 9.8
In the Store Commander scfixmyprestashop module through 2023-05-09 for PrestaShop, sensitive SQL calls can be executed with a trivial HTTP request and exploited to forge a blind SQL injection.
- Product
- Scfixmyprestashop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfriends-of-presta.github.iofriends-of-presta.github.io
May 25, 2023In the Store Commander scexportcustomers module for PrestaShop through 3.6.1, sensitive SQL calls can be executed with a trivial HTTP request and exploited to fCVE-2023-33278 · Other software · Storecommander · reported by MITRECritical 9.8
In the Store Commander scexportcustomers module for PrestaShop through 3.6.1, sensitive SQL calls can be executed with a trivial HTTP request and exploited to forge a blind SQL injection.
- Product
- Customers Export
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfriends-of-presta.github.iostorecommander.com
May 19, 2023Prestashop customexporter <= 1.7.20 is vulnerable to Incorrect Access Control via modules/customexporter/downloads/download.php.CVE-2023-30199 · Other software · Webbax · reported by MITREHigh 7.5
Prestashop customexporter <= 1.7.20 is vulnerable to Incorrect Access Control via modules/customexporter/downloads/download.php.
- Product
- Customexporter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfriends-of-presta.github.iogithub.com
May 17, 2023PrestaShop cdesigner < 3.1.9 is vulnerable to SQL Injection via CdesignerTraitementModuleFrontController::initContent().CVE-2023-30191 · Websites & servers · reported by MITRECritical 9.8
PrestaShop cdesigner < 3.1.9 is vulnerable to SQL Injection via CdesignerTraitementModuleFrontController::initContent().
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfriends-of-presta.github.iofriends-of-presta.github.io
May 16, 2023Insecure permissions vulnerability was discovered, due to a lack of permissions’s control in scquickaccounting before v3.7.3 from Store Commander for PrestaShopCVE-2023-30281 · Other software · Storecommander · reported by MITREMedium 6.5
Insecure permissions vulnerability was discovered, due to a lack of permissions’s control in scquickaccounting before v3.7.3 from Store Commander for PrestaShop, a guest can access exports from the module which can lead to leak of personnal informations from ps_customer table sush as name / surname / email
- Product
- Scquickaccounting
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfriends-of-presta.github.iofriends-of-presta.github.io
May 16, 2023Prestashop posstaticblocks <= 1.0.0 is vulnerable to SQL Injection via posstaticblocks::getPosCurrentHook().CVE-2023-30189 · Other software · Posthemes · reported by MITRECritical 9.8
Prestashop posstaticblocks <= 1.0.0 is vulnerable to SQL Injection via posstaticblocks::getPosCurrentHook().
- Product
- Posstaticblocks
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfriends-of-presta.github.iofriends-of-presta.github.io
May 16, 2023Jenkins File Parameter Plugin 285.v757c5b_67a_c25 and earlier does not restrict the name (and resulting uploaded file name) of Stashed File Parameters, allowingCVE-2023-32986 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comHigh 8.8
Jenkins File Parameter Plugin 285.v757c5b_67a_c25 and earlier does not restrict the name (and resulting uploaded file name) of Stashed File Parameters, allowing attackers with Item/Configure permission to create or replace arbitrary files on the Jenkins controller file system with attacker-specified content.
- Product
- Jenkins File Parameter Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2023Prestashop possearchproducts 1.7 is vulnerable to SQL Injection via PosSearch::find().CVE-2023-30192 · Websites & servers · Prestashop · reported by MITRECritical 9.8
Prestashop possearchproducts 1.7 is vulnerable to SQL Injection via PosSearch::find().
- Product
- Possearchproducts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfriends-of-presta.github.iothemeforest.net
May 10, 2023Prestashop posstaticfooter <= 1.0.0 is vulnerable to SQL Injection via posstaticfooter::getPosCurrentHook().CVE-2023-30194 · Websites & servers · Prestashop · reported by MITRECritical 9.8
Prestashop posstaticfooter <= 1.0.0 is vulnerable to SQL Injection via posstaticfooter::getPosCurrentHook().
- Product
- Poststaticfooter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfriends-of-presta.github.iothemeforest.net
May 4, 2023PrestaShop scexportcustomers <= 3.6.1 is vulnerable to Incorrect Access Control.CVE-2023-30282 · Websites & servers · Prestashop · reported by MITREHigh 7.5
PrestaShop scexportcustomers <= 3.6.1 is vulnerable to Incorrect Access Control. Due to a lack of permissions' control, a guest can access exports from the module which can lead to leak of personal information from customer table.
- Product
- Scexportcustomers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfriends-of-presta.github.iofriends-of-presta.github.io
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.