Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
349 results · page 5 of 7
Apr 25, 2023SQL injection vulnerability found in PrestaShop askforaquote v.5.4.2 and before allow a remote attacker to gain privileges via the QuotesProduct::deleteProduct CVE-2023-27843 · Other software · ASK For A Quote Project · reported by MITRECritical 9.8
SQL injection vulnerability found in PrestaShop askforaquote v.5.4.2 and before allow a remote attacker to gain privileges via the QuotesProduct::deleteProduct component.
- Product
- ASK For A Quote
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaddons.prestashop.comfriends-of-presta.github.io
Apr 25, 2023PrestaShop is an Open Source e-commerce web application.CVE-2023-30839 · Websites & servers · PrestaShop · reported by GitHubCritical 9.9
PrestaShop is an Open Source e-commerce web application. Versions prior to 8.0.4 and 1.7.8.9 contain a SQL filtering vulnerability. A BO user can write, update, and delete in the database, even without having specific rights. PrestaShop 8.0.4 and 1.7.8.9 contain a patch for this issue. There are no known workarounds.
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2023PrestaShop is an Open Source e-commerce web application.CVE-2023-30838 · Websites & servers · PrestaShop · reported by GitHubHigh 8.5
PrestaShop is an Open Source e-commerce web application. Prior to versions 8.0.4 and 1.7.8.9, the `ValidateCore::isCleanHTML()` method of Prestashop misses hijackable events which can lead to cross-site scripting (XSS) injection, allowed by the presence of pre-setup `@keyframes` methods. This XSS, which hijacks HTML attributes, can be triggered without any interaction by the visitor/administrator, which makes it as dangerous as a trivial XSS attack. Contrary to other attacks which target HTML attributes and are triggered without user interaction (such as onload / onerror which suffer from a very limited scope), this one can hijack every HTML element, which increases the danger due to a complete HTML elements scope. Versions 8.0.4 and 1.7.8.9 contain a fix for this issue.
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2023PrestaShop is an Open Source e-commerce web application.CVE-2023-30545 · Websites & servers · PrestaShop · reported by GitHubHigh 7.7
PrestaShop is an Open Source e-commerce web application. Prior to versions 8.0.4 and 1.7.8.9, it is possible for a user with access to the SQL Manager (Advanced Options -> Database) to arbitrarily read any file on the operating system when using SQL function `LOAD_FILE` in a `SELECT` request. This gives the user access to critical information. A patch is available in PrestaShop 8.0.4 and PS 1.7.8.9
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2023SQL injection vulnerability found in PrestaShop bdroppy v.2.2.12 and before allowing a remote attacker to gain privileges via the BdroppyCronModuleFrontControllCVE-2023-26865 · Other software · Brandsdistribution · reported by MITRECritical 9.8
SQL injection vulnerability found in PrestaShop bdroppy v.2.2.12 and before allowing a remote attacker to gain privileges via the BdroppyCronModuleFrontController::importProducts component.
- Product
- Bdroppy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbdroppy.comfriends-of-presta.github.io
Apr 18, 2023Shoppingfeed PrestaShop is an add-on to the PrestaShop ecommerce platform to synchronize data.CVE-2023-28839 · Other software · shoppingflux · reported by GitHubCritical 9.4
Shoppingfeed PrestaShop is an add-on to the PrestaShop ecommerce platform to synchronize data. The module Shoppingfeed for PrestaShop is vulnerable to SQL injection between version 1.4.0 and 1.8.2 due to a lack of input sanitization. This issue has been addressed in version 1.8.3. Users are advised to upgrade. There are no known workarounds for this issue.
- Product
- module-prestashop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2023SQL injection vulnerability found in PrestaShopleurlrewrite v.1.0 and before allow a remote attacker to gain privileges via the Dispatcher::getController componCVE-2023-27844 · Other software · Litextension · reported by MITRECritical 9.8
SQL injection vulnerability found in PrestaShopleurlrewrite v.1.0 and before allow a remote attacker to gain privileges via the Dispatcher::getController component.
- Product
- Leurlrewrite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfriends-of-presta.github.iolitextension.com
Apr 12, 2023Prestashop advancedpopupcreator v1.1.21 to v1.1.24 was discovered to contain a SQL injection vulnerability via the component AdvancedPopup::getPopups().CVE-2023-27032 · Other software · Idnovate · reported by MITRECritical 9.8
Prestashop advancedpopupcreator v1.1.21 to v1.1.24 was discovered to contain a SQL injection vulnerability via the component AdvancedPopup::getPopups().
- Product
- Popup Module (on Entering, Exit Popup, ADD Product) And Newsletter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaddons.prestashop.comfriends-of-presta.github.io
Apr 10, 2023SQL injection vulnerability found in PrestaShop Igbudget v.1.0.3 and before allow a remote attacker to gain privileges via the LgBudgetBudgetModuleFrontControllCVE-2023-26860 · Other software · Save Your Carts And BUY Later OR Send IT Project · reported by MITREHigh 8.8
SQL injection vulnerability found in PrestaShop Igbudget v.1.0.3 and before allow a remote attacker to gain privileges via the LgBudgetBudgetModuleFrontController::displayAjaxGenerateBudget component.
- Product
- Save Your Carts And BUY Later OR Send IT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaddons.prestashop.comfriends-of-presta.github.io
Apr 7, 2023Prestashop cdesigner v3.1.3 to v3.1.8 was discovered to contain a code injection vulnerability via the component CdesignerSaverotateModuleFrontController::initCCVE-2023-27033 · Other software · Cdesigner Project · reported by MITRECritical 9.8
Prestashop cdesigner v3.1.3 to v3.1.8 was discovered to contain a code injection vulnerability via the component CdesignerSaverotateModuleFrontController::initContent().
- Product
- Cdesigner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaddons.prestashop.comfriends-of-presta.github.io
Mar 31, 2023SQL injection vulnerability found in PrestaSHp faqs v.3.1.6 allows a remote attacker to escalate privileges via the faqsBudgetModuleFrontController::displayAjaxCVE-2023-26858 · Other software · Myprestamodules · reported by MITRECritical 9.8
SQL injection vulnerability found in PrestaSHp faqs v.3.1.6 allows a remote attacker to escalate privileges via the faqsBudgetModuleFrontController::displayAjaxGenerateBudget component.
- Product
- Frequently Asked Questions Page
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaddons.prestashop.comfriends-of-presta.github.io
Mar 31, 2023PrestaShop/paypal is an open source module for the PrestaShop web commerce ecosystem which provides paypal payment support.CVE-2023-28843 · Other software · 202ecommerce · reported by GitHubCritical 9.8
PrestaShop/paypal is an open source module for the PrestaShop web commerce ecosystem which provides paypal payment support. A SQL injection vulnerability found in the PrestaShop paypal module from release from 3.12.0 to and including 3.16.3 allow a remote attacker to gain privileges, modify data, and potentially affect system availability. The cause of this issue is that SQL queries were being constructed with user input which had not been properly filtered. Only deployments on PrestaShop 1.6 are affected. Users are advised to upgrade to module version 3.16.4. There are no known workarounds for this vulnerability.
- Product
- paypal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2023SQL injection vulnerability found in PrestaShop xipblog v.2.0.1 and before allow a remote attacker to gain privileges via the xipcategoryclass and xippostsclassCVE-2023-27847 · Other software · Xipblog Project · reported by MITRECritical 9.8
SQL injection vulnerability found in PrestaShop xipblog v.2.0.1 and before allow a remote attacker to gain privileges via the xipcategoryclass and xippostsclass components.
- Product
- Xipblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfriends-of-presta.github.iogithub.com
Mar 24, 2023SQL injection vulnerability found in PrestaShop smplredirectionsmanager v.1.1.19 and before allow a remote attacker to gain privileges via the SmplTools::getMatCVE-2023-26864 · Other software · Smplredirectionsmanager Project · reported by MITRECritical 9.8
SQL injection vulnerability found in PrestaShop smplredirectionsmanager v.1.1.19 and before allow a remote attacker to gain privileges via the SmplTools::getMatchingRedirectionsFromPartscomponent.
- Product
- Smplredirectionsmanager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfriends-of-presta.github.iofriends-of-presta.github.io
Mar 23, 2023PrestaShop jmsblog 2.5.5 was discovered to contain a SQL injection vulnerability.CVE-2023-27034 · Other software · Joommasters · reported by MITRECritical 9.8
PrestaShop jmsblog 2.5.5 was discovered to contain a SQL injection vulnerability.
- Product
- JMS Blog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfriends-of-presta.github.iofriends-of-presta.github.io
Mar 22, 2023An issue was discovered in the tshirtecommerce (aka Custom Product Designer) component 2.1.4 for PrestaShop.CVE-2023-27638 · Other software · Tshirtecommerce · reported by MITRECritical 9.8
An issue was discovered in the tshirtecommerce (aka Custom Product Designer) component 2.1.4 for PrestaShop. An HTTP request can be forged with a compromised tshirtecommerce_design_cart_id GET parameter in order to exploit an insecure parameter in the functions hookActionCartSave and updateCustomizationTable, which could lead to a SQL injection. This is exploited in the wild in March 2023.
- Product
- Custom Product Designer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodecanyon.netfriends-of-presta.github.io
Mar 22, 2023An issue was discovered in the tshirtecommerce (aka Custom Product Designer) component 2.1.4 for PrestaShop.CVE-2023-27637 · Other software · Tshirtecommerce · reported by MITRECritical 9.8
An issue was discovered in the tshirtecommerce (aka Custom Product Designer) component 2.1.4 for PrestaShop. An HTTP request can be forged with a compromised product_id GET parameter in order to exploit an insecure parameter in the front controller file designer.php, which could lead to a SQL injection. This is exploited in the wild in March 2023.
- Product
- Custom Product Designer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodecanyon.netfriends-of-presta.github.io
Mar 21, 2023The eo_tags package before 1.4.19 for PrestaShop allows SQL injection via a crafted _ga cookie.CVE-2023-27570 · Websites & servers · Prestashop · reported by MITRECritical 9.8
The eo_tags package before 1.4.19 for PrestaShop allows SQL injection via a crafted _ga cookie.
- Product
- EO Tags
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordprofileo.comsecurity.profileo.com
Mar 21, 2023The eo_tags package before 1.3.0 for PrestaShop allows SQL injection via an HTTP User-Agent or Referer header.CVE-2023-27569 · Websites & servers · Prestashop · reported by MITRECritical 9.8
The eo_tags package before 1.3.0 for PrestaShop allows SQL injection via an HTTP User-Agent or Referer header.
- Product
- EO Tags
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordprofileo.comsecurity.profileo.com
Mar 14, 2023PrestaShop ws_productreviews < 3.6.2 is vulnerable to SQL Injection.CVE-2023-25206 · Websites & servers · Prestashop · reported by MITREHigh 8.8
PrestaShop ws_productreviews < 3.6.2 is vulnerable to SQL Injection.
- Product
- Advanced Reviews
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaddons.prestashop.comfriends-of-presta.github.io
Mar 13, 2023PrestaShop dpdfrance <6.1.3 is vulnerable to SQL Injection via dpdfrance/ajax.php.CVE-2023-25207 · Websites & servers · reported by MITRECritical 9.8
PrestaShop dpdfrance <6.1.3 is vulnerable to SQL Injection via dpdfrance/ajax.php.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaddons.prestashop.comfriends-of-presta.github.io
Mar 13, 2023PrestaShop is an open source e-commerce web application that, prior to version 8.0.1, is vulnerable to cross-site request forgery (CSRF).CVE-2023-25170 · Websites & servers · PrestaShop · reported by GitHubMedium 5
PrestaShop is an open source e-commerce web application that, prior to version 8.0.1, is vulnerable to cross-site request forgery (CSRF). When authenticating users, PrestaShop preserves session attributes. Because this does not clear CSRF tokens upon login, this might enable same-site attackers to bypass the CSRF protection mechanism by performing an attack similar to a session-fixation. The problem is fixed in version 8.0.1.
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2023In the module "Xen Forum" (xenforum) for PrestaShop, an authenticated user can perform SQL injection in versions up to 2.13.0.CVE-2023-24763 · Websites & servers · Prestashop · reported by MITREHigh 8.8
In the module "Xen Forum" (xenforum) for PrestaShop, an authenticated user can perform SQL injection in versions up to 2.13.0.
- Product
- XEN Forum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaddons.prestashop.comfriends-of-presta.github.io
Mar 1, 2023The PrestaShop e-commerce platform module stripejs contains a Blind SQL injection vulnerability up to version 4.5.5.CVE-2023-23315 · Other software · Stripe · reported by MITRECritical 9.8
The PrestaShop e-commerce platform module stripejs contains a Blind SQL injection vulnerability up to version 4.5.5. The method `stripejsValidationModuleFrontController::initContent()` has sensitive SQL calls that can be executed with a trivial http call and exploited to forge a SQL injection.
- Product
- Stripe Payment Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfriends-of-presta.github.iofriends-of-presta.github.io
Feb 2, 2023PrestaShop module, totadministrativemandate before v1.7.1 was discovered to contain a SQL injection vulnerability.CVE-2022-46965 · Websites & servers · reported by MITREHigh 8.1
PrestaShop module, totadministrativemandate before v1.7.1 was discovered to contain a SQL injection vulnerability.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2023A vulnerability in the descarga_etiqueta.php component of Correos Prestashop 1.7.x allows attackers to execute a directory traversal.CVE-2022-46639 · Other software · Correos · reported by MITREHigh 7.5
A vulnerability in the descarga_etiqueta.php component of Correos Prestashop 1.7.x allows attackers to execute a directory traversal.
- Product
- Correos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordia-informatica.comia-informatica.com
Dec 8, 2022PrestaShop is an open-source e-commerce solution.CVE-2022-46158 · Websites & servers · PrestaShop · reported by GitHubMedium 5.3
PrestaShop is an open-source e-commerce solution. Versions prior to 1.7.8.8 did not properly restrict host filesystem access for users. Users may have been able to view the contents of the upload directory without appropriate permissions. This issue has been addressed and users are advised to upgrade to version 1.7.8.8. There are no known workarounds for this issue.
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2022The EU Cookie Law GDPR (Banner + Blocker) module before 2.1.3 for PrestaShop allows SQL Injection via a cookie ( lgcookieslaw or __lglaw ).CVE-2022-44727 · Other software · Lineagrafica · reported by MITRECritical 9.1
The EU Cookie Law GDPR (Banner + Blocker) module before 2.1.3 for PrestaShop allows SQL Injection via a cookie ( lgcookieslaw or __lglaw ).
- Product
- EU Cookie LAW Gdpr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaddons.prestashop.comsecurityandstuff.com
Sep 28, 2022`@next-auth/upstash-redis-adapter` is the Upstash Redis adapter for NextAuth.js, which provides authentication for Next.js.CVE-2022-39263 · Other software · nextauthjs · reported by GitHubMedium 6.8
`@next-auth/upstash-redis-adapter` is the Upstash Redis adapter for NextAuth.js, which provides authentication for Next.js. Applications that use `next-auth` Email Provider and `@next-auth/upstash-redis-adapter` before v3.0.2 are affected by this vulnerability. The Upstash Redis adapter implementation did not check for both the identifier (email) and the token, but only checking for the identifier when verifying the token in the email callback flow. An attacker who knows about the victim's email could easily sign in as the victim, given the attacker also knows about the verification token's expired duration. The vulnerability is patched in v3.0.2. A workaround is available. Using Advanced Initialization, developers can check the requests and compare the query's token and identifier before proceeding.
- Product
- next-auth
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2022This package is a PrestaShop module that allows users to post reviews and rate products.CVE-2022-35933 · Websites & servers · PrestaShop · reported by GitHubMedium 6.1
This package is a PrestaShop module that allows users to post reviews and rate products. There is a vulnerability where the attacker could steal an administrator's cookie. The issue is fixed in version 5.0.2.
- Product
- productcomments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2022A SQL injection vulnerability in the product_all_one_img and image_product parameters of the ApolloTheme AP PageBuilder component through 2.4.4 for PrestaShop aCVE-2022-22897 · Other software · Apollotheme · reported by MITRECritical 9.8
A SQL injection vulnerability in the product_all_one_img and image_product parameters of the ApolloTheme AP PageBuilder component through 2.4.4 for PrestaShop allows unauthenticated attackers to exfiltrate database data.
- Product
- AP Pagebuilder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comfriends-of-presta.github.io
Aug 1, 2022PrestaShop is an Open Source e-commerce platform.CVE-2022-31181 · Websites & servers · PrestaShop · reported by GitHubCritical 9.8
PrestaShop is an Open Source e-commerce platform. In versions from 1.6.0.10 and before 1.7.8.7 PrestaShop is subject to an SQL injection vulnerability which can be chained to call PHP's Eval function on attacker input. The problem is fixed in version 1.7.8.7. Users are advised to upgrade. Users unable to upgrade may delete the MySQL Smarty cache feature.
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2022File upload vulnerability in the Catalog feature in Prestashop 1.7.6.7 allows remote attackers to run arbitrary code via the add new file page.CVE-2020-21967 · Websites & servers · Prestashop · reported by MITREMedium 4.8
File upload vulnerability in the Catalog feature in Prestashop 1.7.6.7 allows remote attackers to run arbitrary code via the add new file page.
- Product
- Prestashop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Jul 10, 2022The Luxas98/logstash-management-api repository through 2020-05-04 on GitHub allows absolute path traversal because the Flask send_file function is used unsafelyCVE-2022-31520 · Other software · Logstash-management-api Project · reported by MITRECritical 9.3
The Luxas98/logstash-management-api repository through 2020-05-04 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Logstash-management-api
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2022prestashop/blockwishlist is a prestashop extension which adds a block containing the customer's wishlists.CVE-2022-31101 · Websites & servers · PrestaShop · reported by GitHubHigh 8.1
prestashop/blockwishlist is a prestashop extension which adds a block containing the customer's wishlists. In affected versions an authenticated customer can perform SQL injection. This issue is fixed in version 2.1.1. Users are advised to upgrade. There are no known workarounds for this issue.
- Product
- blockwishlist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Jun 23, 2022Jenkins Stash Branch Parameter Plugin 0.3.0 and earlier does not escape the name and description of Stash Branch parameters on views displaying parameters, resuCVE-2022-34198 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Stash Branch Parameter Plugin 0.3.0 and earlier does not escape the name and description of Stash Branch parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- Product
- Jenkins Stash Branch Parameter Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2022PrestaShop is an Open Source e-commerce platform.CVE-2022-21686 · Websites & servers · PrestaShop · reported by GitHubCritical 9
PrestaShop is an Open Source e-commerce platform. Starting with version 1.7.0.0 and ending with version 1.7.8.3, an attacker is able to inject twig code inside the back office when using the legacy layout. The problem is fixed in version 1.7.8.3. There are no known workarounds.
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 21, 2021PrestaShop before 1.5.2 allows XSS via the "<object data='data:text/html" substring in the message field.CVE-2012-20001 · Websites & servers · Prestashop · reported by MITREMedium 6.1
PrestaShop before 1.5.2 allows XSS via the "<object data='data:text/html" substring in the message field.
- Product
- Prestashop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Dec 7, 2021PrestaShop is an Open Source e-commerce web application.CVE-2021-43789 · Websites & servers · PrestaShop · reported by GitHubHigh 7.5
PrestaShop is an Open Source e-commerce web application. Versions of PrestaShop prior to 1.7.8.2 are vulnerable to blind SQL injection using search filters with `orderBy` and `sortOrder` parameters. The problem is fixed in version 1.7.8.2.
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2021The Customer Photo Gallery addon before 2.9.4 for PrestaShop is vulnerable to SQL injection.CVE-2021-40814 · Other software · Mypresta · reported by MITRECritical 9.8
The Customer Photo Gallery addon before 2.9.4 for PrestaShop is vulnerable to SQL injection.
- Product
- Customer Photo Gallery
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgetastra.comgetastra.com
Aug 24, 2021Multiple SQL injection vulnerabilities in SmartDataSoft SmartBlog for PrestaShop before 4.06 allow a remote unauthenticated attacker to execute arbitrary SQL coCVE-2021-37538 · Other software · Smartdatasoft · reported by MITRECritical 9.8
Multiple SQL injection vulnerabilities in SmartDataSoft SmartBlog for PrestaShop before 4.06 allow a remote unauthenticated attacker to execute arbitrary SQL commands via the day, month, or year parameter to the controllers/front/archive.php archive controller, or the id_category parameter to the controllers/front/category.php category controller.
- Product
- Smartblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.sorcery.ieclassydevs.com
Aug 20, 2021A SQL Injection issue in the list controller of the Prestahome Blog (aka ph_simpleblog) module before 1.7.8 for Prestashop allows a remote attacker to extract dCVE-2021-36748 · Other software · Prestahome · reported by MITREHigh 7.5
A SQL Injection issue in the list controller of the Prestahome Blog (aka ph_simpleblog) module before 1.7.8 for Prestashop allows a remote attacker to extract data from the database via the sb_category parameter.
- Product
- Blog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordalysum5.promokit.eublog.sorcery.ie
May 13, 2021In Logstash versions after 6.4.0 and before 6.8.15 and 7.12.0 a TLS certificate validation flaw was found in the monitoring feature.CVE-2021-22138 · Other software · Elastic · reported by security@elastic.coLow 3.7
In Logstash versions after 6.4.0 and before 6.8.15 and 7.12.0 a TLS certificate validation flaw was found in the monitoring feature. When specifying a trusted server CA certificate Logstash would not properly verify the certificate returned by the monitoring server. This could result in a man in the middle style attack against the Logstash monitoring data.
- Product
- Elasticsearch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.elastic.cosecurity.netapp.com
Mar 31, 2021ps_emailsubscription is a newsletter subscription module for the PrestaShop platform.CVE-2021-21418 · Websites & servers · PrestaShop · reported by GitHubMedium 4.6
ps_emailsubscription is a newsletter subscription module for the PrestaShop platform. An employee can inject javascript in the newsletter condition field that will then be executed on the front office The issue has been fixed in 2.6.1
- Product
- ps_emailsubscription
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2021PrestaShop is a fully scalable open source e-commerce solution.CVE-2021-21398 · Websites & servers · PrestaShop · reported by GitHubMedium 5.4
PrestaShop is a fully scalable open source e-commerce solution. In PrestaShop before version 1.7.7.3, an attacker can inject HTML when the Grid Column Type DataColumn is badly used. The problem is fixed in 1.7.7.3
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2021PrestaShop is a fully scalable open source e-commerce solution.CVE-2021-21308 · Websites & servers · PrestaShop · reported by GitHubMedium 6.1
PrestaShop is a fully scalable open source e-commerce solution. In PrestaShop before version 1.7.2 the soft logout system is not complete and an attacker is able to foreign request and executes customer commands. The problem is fixed in 1.7.7.2
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2021PrestaShop is a fully scalable open source e-commerce solution.CVE-2021-21302 · Websites & servers · PrestaShop · reported by GitHubMedium 6.8
PrestaShop is a fully scalable open source e-commerce solution. In PrestaShop before version 1.7.2 there is a CSV Injection vulnerability possible by using shop search keywords via the admin panel. The problem is fixed in 1.7.7.2
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2021An Insecure Direct Object Reference (IDOR) vulnerability was found in Prestashop Opart devis < 4.0.2.CVE-2020-16194 · Other software · Store-opart · reported by MITREMedium 5.3
An Insecure Direct Object Reference (IDOR) vulnerability was found in Prestashop Opart devis < 4.0.2. Unauthenticated attackers can have access to any user's invoice and delivery address by exploiting an IDOR on the delivery_address and invoice_address fields.
- Product
- Op'art Devis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2021The store system in PrestaShop 1.7.7.0 allows time-based boolean SQL injection via the module=productcomments controller=CommentGrade id_products[] parameter.CVE-2021-3110 · Websites & servers · Prestashop · reported by MITRECritical 9.8
The store system in PrestaShop 1.7.7.0 allows time-based boolean SQL injection via the module=productcomments controller=CommentGrade id_products[] parameter.
- Product
- Prestashop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmedium.comexploit-db.com
Dec 3, 2020In the PrestaShop module "productcomments" before version 4.2.1, an attacker can use a Blind SQL injection to retrieve data or stop the MySQL service.CVE-2020-26248 · Websites & servers · PrestaShop · reported by GitHubMedium 6.8
In the PrestaShop module "productcomments" before version 4.2.1, an attacker can use a Blind SQL injection to retrieve data or stop the MySQL service. The problem is fixed in 4.2.1 of the module.
- Product
- productcomments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.