Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
298 results · page 5 of 6
Mar 21, 2023The eo_tags package before 1.3.0 for PrestaShop allows SQL injection via an HTTP User-Agent or Referer header.CVE-2023-27569 · Websites & servers · Prestashop · reported by MITRECritical 9.8
The eo_tags package before 1.3.0 for PrestaShop allows SQL injection via an HTTP User-Agent or Referer header.
- Product
- EO Tags
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordprofileo.comsecurity.profileo.com
Mar 14, 2023PrestaShop ws_productreviews < 3.6.2 is vulnerable to SQL Injection.CVE-2023-25206 · Websites & servers · Prestashop · reported by MITREHigh 8.8
PrestaShop ws_productreviews < 3.6.2 is vulnerable to SQL Injection.
- Product
- Advanced Reviews
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaddons.prestashop.comfriends-of-presta.github.io
Mar 13, 2023PrestaShop dpdfrance <6.1.3 is vulnerable to SQL Injection via dpdfrance/ajax.php.CVE-2023-25207 · Websites & servers · reported by MITRECritical 9.8
PrestaShop dpdfrance <6.1.3 is vulnerable to SQL Injection via dpdfrance/ajax.php.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaddons.prestashop.comfriends-of-presta.github.io
Mar 13, 2023PrestaShop is an open source e-commerce web application that, prior to version 8.0.1, is vulnerable to cross-site request forgery (CSRF).CVE-2023-25170 · Websites & servers · PrestaShop · reported by GitHubMedium 5
PrestaShop is an open source e-commerce web application that, prior to version 8.0.1, is vulnerable to cross-site request forgery (CSRF). When authenticating users, PrestaShop preserves session attributes. Because this does not clear CSRF tokens upon login, this might enable same-site attackers to bypass the CSRF protection mechanism by performing an attack similar to a session-fixation. The problem is fixed in version 8.0.1.
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2023In the module "Xen Forum" (xenforum) for PrestaShop, an authenticated user can perform SQL injection in versions up to 2.13.0.CVE-2023-24763 · Websites & servers · Prestashop · reported by MITREHigh 8.8
In the module "Xen Forum" (xenforum) for PrestaShop, an authenticated user can perform SQL injection in versions up to 2.13.0.
- Product
- XEN Forum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaddons.prestashop.comfriends-of-presta.github.io
Mar 1, 2023The PrestaShop e-commerce platform module stripejs contains a Blind SQL injection vulnerability up to version 4.5.5.CVE-2023-23315 · Other software · Stripe · reported by MITRECritical 9.8
The PrestaShop e-commerce platform module stripejs contains a Blind SQL injection vulnerability up to version 4.5.5. The method `stripejsValidationModuleFrontController::initContent()` has sensitive SQL calls that can be executed with a trivial http call and exploited to forge a SQL injection.
- Product
- Stripe Payment Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfriends-of-presta.github.iofriends-of-presta.github.io
Feb 2, 2023PrestaShop module, totadministrativemandate before v1.7.1 was discovered to contain a SQL injection vulnerability.CVE-2022-46965 · Websites & servers · reported by MITREHigh 8.1
PrestaShop module, totadministrativemandate before v1.7.1 was discovered to contain a SQL injection vulnerability.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2023A vulnerability in the descarga_etiqueta.php component of Correos Prestashop 1.7.x allows attackers to execute a directory traversal.CVE-2022-46639 · Other software · Correos · reported by MITREHigh 7.5
A vulnerability in the descarga_etiqueta.php component of Correos Prestashop 1.7.x allows attackers to execute a directory traversal.
- Product
- Correos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordia-informatica.comia-informatica.com
Dec 8, 2022PrestaShop is an open-source e-commerce solution.CVE-2022-46158 · Websites & servers · PrestaShop · reported by GitHubMedium 5.3
PrestaShop is an open-source e-commerce solution. Versions prior to 1.7.8.8 did not properly restrict host filesystem access for users. Users may have been able to view the contents of the upload directory without appropriate permissions. This issue has been addressed and users are advised to upgrade to version 1.7.8.8. There are no known workarounds for this issue.
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2022The EU Cookie Law GDPR (Banner + Blocker) module before 2.1.3 for PrestaShop allows SQL Injection via a cookie ( lgcookieslaw or __lglaw ).CVE-2022-44727 · Other software · Lineagrafica · reported by MITRECritical 9.1
The EU Cookie Law GDPR (Banner + Blocker) module before 2.1.3 for PrestaShop allows SQL Injection via a cookie ( lgcookieslaw or __lglaw ).
- Product
- EU Cookie LAW Gdpr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaddons.prestashop.comsecurityandstuff.com
Sep 2, 2022This package is a PrestaShop module that allows users to post reviews and rate products.CVE-2022-35933 · Websites & servers · PrestaShop · reported by GitHubMedium 6.1
This package is a PrestaShop module that allows users to post reviews and rate products. There is a vulnerability where the attacker could steal an administrator's cookie. The issue is fixed in version 5.0.2.
- Product
- productcomments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2022A SQL injection vulnerability in the product_all_one_img and image_product parameters of the ApolloTheme AP PageBuilder component through 2.4.4 for PrestaShop aCVE-2022-22897 · Other software · Apollotheme · reported by MITRECritical 9.8
A SQL injection vulnerability in the product_all_one_img and image_product parameters of the ApolloTheme AP PageBuilder component through 2.4.4 for PrestaShop allows unauthenticated attackers to exfiltrate database data.
- Product
- AP Pagebuilder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comfriends-of-presta.github.io
Aug 1, 2022PrestaShop is an Open Source e-commerce platform.CVE-2022-31181 · Websites & servers · PrestaShop · reported by GitHubCritical 9.8
PrestaShop is an Open Source e-commerce platform. In versions from 1.6.0.10 and before 1.7.8.7 PrestaShop is subject to an SQL injection vulnerability which can be chained to call PHP's Eval function on attacker input. The problem is fixed in version 1.7.8.7. Users are advised to upgrade. Users unable to upgrade may delete the MySQL Smarty cache feature.
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2022File upload vulnerability in the Catalog feature in Prestashop 1.7.6.7 allows remote attackers to run arbitrary code via the add new file page.CVE-2020-21967 · Websites & servers · Prestashop · reported by MITREMedium 4.8
File upload vulnerability in the Catalog feature in Prestashop 1.7.6.7 allows remote attackers to run arbitrary code via the add new file page.
- Product
- Prestashop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Jun 27, 2022prestashop/blockwishlist is a prestashop extension which adds a block containing the customer's wishlists.CVE-2022-31101 · Websites & servers · PrestaShop · reported by GitHubHigh 8.1
prestashop/blockwishlist is a prestashop extension which adds a block containing the customer's wishlists. In affected versions an authenticated customer can perform SQL injection. This issue is fixed in version 2.1.1. Users are advised to upgrade. There are no known workarounds for this issue.
- Product
- blockwishlist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Jan 26, 2022PrestaShop is an Open Source e-commerce platform.CVE-2022-21686 · Websites & servers · PrestaShop · reported by GitHubCritical 9
PrestaShop is an Open Source e-commerce platform. Starting with version 1.7.0.0 and ending with version 1.7.8.3, an attacker is able to inject twig code inside the back office when using the legacy layout. The problem is fixed in version 1.7.8.3. There are no known workarounds.
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 21, 2021PrestaShop before 1.5.2 allows XSS via the "<object data='data:text/html" substring in the message field.CVE-2012-20001 · Websites & servers · Prestashop · reported by MITREMedium 6.1
PrestaShop before 1.5.2 allows XSS via the "<object data='data:text/html" substring in the message field.
- Product
- Prestashop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Dec 7, 2021PrestaShop is an Open Source e-commerce web application.CVE-2021-43789 · Websites & servers · PrestaShop · reported by GitHubHigh 7.5
PrestaShop is an Open Source e-commerce web application. Versions of PrestaShop prior to 1.7.8.2 are vulnerable to blind SQL injection using search filters with `orderBy` and `sortOrder` parameters. The problem is fixed in version 1.7.8.2.
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2021The Customer Photo Gallery addon before 2.9.4 for PrestaShop is vulnerable to SQL injection.CVE-2021-40814 · Other software · Mypresta · reported by MITRECritical 9.8
The Customer Photo Gallery addon before 2.9.4 for PrestaShop is vulnerable to SQL injection.
- Product
- Customer Photo Gallery
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgetastra.comgetastra.com
Aug 24, 2021Multiple SQL injection vulnerabilities in SmartDataSoft SmartBlog for PrestaShop before 4.06 allow a remote unauthenticated attacker to execute arbitrary SQL coCVE-2021-37538 · Other software · Smartdatasoft · reported by MITRECritical 9.8
Multiple SQL injection vulnerabilities in SmartDataSoft SmartBlog for PrestaShop before 4.06 allow a remote unauthenticated attacker to execute arbitrary SQL commands via the day, month, or year parameter to the controllers/front/archive.php archive controller, or the id_category parameter to the controllers/front/category.php category controller.
- Product
- Smartblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.sorcery.ieclassydevs.com
Aug 20, 2021A SQL Injection issue in the list controller of the Prestahome Blog (aka ph_simpleblog) module before 1.7.8 for Prestashop allows a remote attacker to extract dCVE-2021-36748 · Other software · Prestahome · reported by MITREHigh 7.5
A SQL Injection issue in the list controller of the Prestahome Blog (aka ph_simpleblog) module before 1.7.8 for Prestashop allows a remote attacker to extract data from the database via the sb_category parameter.
- Product
- Blog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordalysum5.promokit.eublog.sorcery.ie
Mar 31, 2021ps_emailsubscription is a newsletter subscription module for the PrestaShop platform.CVE-2021-21418 · Websites & servers · PrestaShop · reported by GitHubMedium 4.6
ps_emailsubscription is a newsletter subscription module for the PrestaShop platform. An employee can inject javascript in the newsletter condition field that will then be executed on the front office The issue has been fixed in 2.6.1
- Product
- ps_emailsubscription
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2021PrestaShop is a fully scalable open source e-commerce solution.CVE-2021-21398 · Websites & servers · PrestaShop · reported by GitHubMedium 5.4
PrestaShop is a fully scalable open source e-commerce solution. In PrestaShop before version 1.7.7.3, an attacker can inject HTML when the Grid Column Type DataColumn is badly used. The problem is fixed in 1.7.7.3
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2021PrestaShop is a fully scalable open source e-commerce solution.CVE-2021-21308 · Websites & servers · PrestaShop · reported by GitHubMedium 6.1
PrestaShop is a fully scalable open source e-commerce solution. In PrestaShop before version 1.7.2 the soft logout system is not complete and an attacker is able to foreign request and executes customer commands. The problem is fixed in 1.7.7.2
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2021PrestaShop is a fully scalable open source e-commerce solution.CVE-2021-21302 · Websites & servers · PrestaShop · reported by GitHubMedium 6.8
PrestaShop is a fully scalable open source e-commerce solution. In PrestaShop before version 1.7.2 there is a CSV Injection vulnerability possible by using shop search keywords via the admin panel. The problem is fixed in 1.7.7.2
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2021An Insecure Direct Object Reference (IDOR) vulnerability was found in Prestashop Opart devis < 4.0.2.CVE-2020-16194 · Other software · Store-opart · reported by MITREMedium 5.3
An Insecure Direct Object Reference (IDOR) vulnerability was found in Prestashop Opart devis < 4.0.2. Unauthenticated attackers can have access to any user's invoice and delivery address by exploiting an IDOR on the delivery_address and invoice_address fields.
- Product
- Op'art Devis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2021The store system in PrestaShop 1.7.7.0 allows time-based boolean SQL injection via the module=productcomments controller=CommentGrade id_products[] parameter.CVE-2021-3110 · Websites & servers · Prestashop · reported by MITRECritical 9.8
The store system in PrestaShop 1.7.7.0 allows time-based boolean SQL injection via the module=productcomments controller=CommentGrade id_products[] parameter.
- Product
- Prestashop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmedium.comexploit-db.com
Dec 3, 2020In the PrestaShop module "productcomments" before version 4.2.1, an attacker can use a Blind SQL injection to retrieve data or stop the MySQL service.CVE-2020-26248 · Websites & servers · PrestaShop · reported by GitHubMedium 6.8
In the PrestaShop module "productcomments" before version 4.2.1, an attacker can use a Blind SQL injection to retrieve data or stop the MySQL service. The problem is fixed in 4.2.1 of the module.
- Product
- productcomments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Nov 16, 2020In PrestaShop Product Comments before version 4.2.0, an attacker could inject malicious web code into the users' web browsers by creating a malicious link.CVE-2020-26225 · Websites & servers · PrestaShop · reported by GitHubHigh 8.7
In PrestaShop Product Comments before version 4.2.0, an attacker could inject malicious web code into the users' web browsers by creating a malicious link. The problem was introduced in version 4.0.0 and is fixed in 4.2.0
- Product
- productcomments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2020In PrestaShop before version 1.7.6.9 an attacker is able to list all the orders placed on the website without being logged by abusing the function that allows aCVE-2020-26224 · Websites & servers · PrestaShop · reported by GitHubHigh 7.5
In PrestaShop before version 1.7.6.9 an attacker is able to list all the orders placed on the website without being logged by abusing the function that allows a shopping cart to be recreated from an order already placed. The problem is fixed in 1.7.6.9.
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 2, 2020The Module Olea Gift On Order module through 5.0.8 for PrestaShop enables an unauthenticated user to read arbitrary files on the server via getfile.php?file=/..CVE-2020-9368 · Other software · Oleacorner · reported by MITREHigh 7.5
The Module Olea Gift On Order module through 5.0.8 for PrestaShop enables an unauthenticated user to read arbitrary files on the server via getfile.php?file=/.. directory traversal.
- Product
- Olea Gift ON Order
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comintrinsec.com
Sep 24, 2020In PrestaShop from version 1.5.0.0 and before version 1.7.6.8, users are allowed to send compromised files.CVE-2020-15162 · Websites & servers · PrestaShop · reported by GitHubMedium 5.4
In PrestaShop from version 1.5.0.0 and before version 1.7.6.8, users are allowed to send compromised files. These attachments allowed people to input malicious JavaScript which triggered an XSS payload. The problem is fixed in version 1.7.6.8.
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2020PrestaShop from version 1.7.5.0 and before version 1.7.6.8 is vulnerable to a blind SQL Injection attack in the Catalog Product edition page with location paramCVE-2020-15160 · Websites & servers · PrestaShop · reported by GitHubCritical 9.8
PrestaShop from version 1.7.5.0 and before version 1.7.6.8 is vulnerable to a blind SQL Injection attack in the Catalog Product edition page with location parameter. The problem is fixed in 1.7.6.8
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Sep 24, 2020In PrestaShop from version 1.6.0.4 and before version 1.7.6.8 an attacker is able to inject javascript while using the contact form.CVE-2020-15161 · Websites & servers · PrestaShop · reported by GitHubMedium 5.4
In PrestaShop from version 1.6.0.4 and before version 1.7.6.8 an attacker is able to inject javascript while using the contact form. The problem is fixed in 1.7.6.8
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2020In PrestaShop contactform module (prestashop/contactform) before version 4.3.0, an attacker is able to inject JavaScript while using the contact form.CVE-2020-15178 · Websites & servers · PrestaShop · reported by GitHubHigh 8
In PrestaShop contactform module (prestashop/contactform) before version 4.3.0, an attacker is able to inject JavaScript while using the contact form. The `message` field was incorrectly unescaped, possibly allowing attackers to execute arbitrary JavaScript in a victim's browser.
- Product
- contactform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2020In PrestaShop Dashboard Productions before version 2.1.0, there is improper authorization which enables an attacker to change the configuration.CVE-2020-15102 · Websites & servers · PrestaShop · reported by GitHubMedium 6.5
In PrestaShop Dashboard Productions before version 2.1.0, there is improper authorization which enables an attacker to change the configuration. The problem is fixed in 2.1.0.
- Product
- dashproducts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2020In PrestaShop from version 1.5.0.0 and before version 1.7.6.6, the authentication system is malformed and an attacker is able to forge requests and execute admiCVE-2020-4074 · Websites & servers · PrestaShop · reported by GitHubHigh 8.9
In PrestaShop from version 1.5.0.0 and before version 1.7.6.6, the authentication system is malformed and an attacker is able to forge requests and execute admin commands. The problem is fixed in 1.7.6.6.
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2020In PrestaShop from version 1.7.0.0 and before version 1.7.6.6, if a target sends a corrupted file, it leads to a reflected XSS.CVE-2020-15083 · Websites & servers · PrestaShop · reported by GitHubMedium 4.7
In PrestaShop from version 1.7.0.0 and before version 1.7.6.6, if a target sends a corrupted file, it leads to a reflected XSS. The problem is fixed in 1.7.6.6
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2020In PrestaShop from version 1.6.0.1 and before version 1.7.6.6, the dashboard allows rewriting all configuration variables.CVE-2020-15082 · Websites & servers · PrestaShop · reported by GitHubHigh 7.1
In PrestaShop from version 1.6.0.1 and before version 1.7.6.6, the dashboard allows rewriting all configuration variables. The problem is fixed in 1.7.6.6
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2020In PrestaShop from version 1.5.0.0 and before 1.7.6.6, there is information exposure in the upload directory.CVE-2020-15081 · Websites & servers · PrestaShop · reported by GitHubMedium 5.3
In PrestaShop from version 1.5.0.0 and before 1.7.6.6, there is information exposure in the upload directory. The problem is fixed in version 1.7.6.6. A possible workaround is to add an empty index.php file in the upload directory.
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2020In PrestaShop from version 1.7.4.0 and before version 1.7.6.6, some files should not be in the release archive, and others should not be accessible.CVE-2020-15080 · Websites & servers · PrestaShop · reported by GitHubMedium 5.3
In PrestaShop from version 1.7.4.0 and before version 1.7.6.6, some files should not be in the release archive, and others should not be accessible. The problem is fixed in version 1.7.6.6 A possible workaround is to make sure `composer.json` and `docker-compose.yml` are not accessible on your server.
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2020In PrestaShop from version 1.5.0.0 and before version 1.7.6.6, there is improper access control in Carrier page, Module Manager and Module Positions.CVE-2020-15079 · Websites & servers · PrestaShop · reported by GitHubMedium 6.4
In PrestaShop from version 1.5.0.0 and before version 1.7.6.6, there is improper access control in Carrier page, Module Manager and Module Positions. The problem is fixed in version 1.7.6.6
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2020In PrestaShop from version 1.5.3.0 and before version 1.7.6.6, there is a stored XSS when using the name of a quick access item.CVE-2020-11074 · Websites & servers · PrestaShop · reported by GitHubMedium 5.4
In PrestaShop from version 1.5.3.0 and before version 1.7.6.6, there is a stored XSS when using the name of a quick access item. The problem is fixed in 1.7.6.6.
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2020The Correos Express addon for PrestaShop 1.6 through 1.7 allows remote attackers to obtain sensitive information, such as a service's owner password that can beCVE-2020-12120 · Websites & servers · Prestashop · reported by MITREHigh 7.5
The Correos Express addon for PrestaShop 1.6 through 1.7 allows remote attackers to obtain sensitive information, such as a service's owner password that can be used to modify orders via SOAP. Attackers can also retrieve information about orders or buyers.
- Product
- Correos Express
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaddons.prestashop.comia-informatica.com
Apr 20, 2020In PrestaShop between versions 1.7.0.0 and 1.7.6.5, there are improper access controls on product page with combinations, attachments and specific prices.CVE-2020-5293 · Websites & servers · PrestaShop · reported by GitHubMedium 6.5
In PrestaShop between versions 1.7.0.0 and 1.7.6.5, there are improper access controls on product page with combinations, attachments and specific prices. The problem is fixed in 1.7.6.5.
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2020"In PrestaShop between versions 1.7.0.0 and 1.7.6.5, there is improper access controls on product attributes page.CVE-2020-5288 · Websites & servers · PrestaShop · reported by GitHubMedium 4.1
"In PrestaShop between versions 1.7.0.0 and 1.7.6.5, there is improper access controls on product attributes page. The problem is fixed in 1.7.6.5.
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2020In PrestaShop between versions 1.5.5.0 and 1.7.6.5, there is improper access control on customers search.CVE-2020-5287 · Websites & servers · PrestaShop · reported by GitHubMedium 4.1
In PrestaShop between versions 1.5.5.0 and 1.7.6.5, there is improper access control on customers search. The problem is fixed in 1.7.6.5.
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2020In PrestaShop between versions 1.7.4.0 and 1.7.6.5, there is a reflected XSS when uploading a wrong file.CVE-2020-5286 · Websites & servers · PrestaShop · reported by GitHubMedium 4.1
In PrestaShop between versions 1.7.4.0 and 1.7.6.5, there is a reflected XSS when uploading a wrong file. The problem is fixed in 1.7.6.5
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2020In PrestaShop between versions 1.7.6.0 and 1.7.6.5, there is a reflected XSS with `back` parameter.CVE-2020-5285 · Websites & servers · PrestaShop · reported by GitHubMedium 4.1
In PrestaShop between versions 1.7.6.0 and 1.7.6.5, there is a reflected XSS with `back` parameter. The problem is fixed in 1.7.6.5
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2020In PrestaShop between versions 1.5.0.0 and 1.7.6.5, there are improper access control since the the version 1.5.0.0 for legacy controllers.CVE-2020-5279 · Websites & servers · PrestaShop · reported by GitHubMedium 4.1
In PrestaShop between versions 1.5.0.0 and 1.7.6.5, there are improper access control since the the version 1.5.0.0 for legacy controllers. - admin-dev/index.php/configure/shop/customer-preferences/ - admin-dev/index.php/improve/international/translations/ - admin-dev/index.php/improve/international/geolocation/ - admin-dev/index.php/improve/international/localization - admin-dev/index.php/configure/advanced/performance - admin-dev/index.php/sell/orders/delivery-slips/ - admin-dev/index.php?controller=AdminStatuses The problem is fixed in 1.7.6.5
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.