CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-43789 – Blind SQLi using Search filters in PrestaShop
https://notcve.org/view.php?id=CVE-2021-43789
PrestaShop is an Open Source e-commerce web application. Versions of PrestaShop prior to 1.7.8.2 are vulnerable to blind SQL injection using search filters with `orderBy` and `sortOrder` parameters. The problem is fixed in version 1.7.8.2. PrestaShop es una aplicación web de comercio electrónico de código abierto. Las versiones de PrestaShop anteriores a 1.7.8.2, son vulnerables a una inyección SQL ciega usando filtros de búsqueda con los parámetros "orderBy" y "sortOrder". • https://github.com/numanturle/CVE-2021-43789 https://github.com/PrestaShop/PrestaShop/issues/26623 https://github.com/PrestaShop/PrestaShop/releases/tag/1.7.8.2 https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-6xxj-gcjq-wgf4 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2021-21418 – Potential XSS injection in the newsletter conditions field
https://notcve.org/view.php?id=CVE-2021-21418
ps_emailsubscription is a newsletter subscription module for the PrestaShop platform. An employee can inject javascript in the newsletter condition field that will then be executed on the front office The issue has been fixed in 2.6.1 ps_emailsubscription es un módulo de suscripción al boletín para la plataforma PrestaShop. Un empleado puede inyectar javascript en el campo de condición del boletín que luego se ejecutará en la oficina principal. El problema se ha solucionado en la versión 2.6.1. • https://github.com/PrestaShop/ps_emailsubscription/commit/664ffb225e2afb4a32640bbedad667dc6e660b70 https://github.com/PrestaShop/ps_emailsubscription/releases/tag/v2.6.1 https://github.com/PrestaShop/ps_emailsubscription/security/advisories/GHSA-vwfx-hh3w-fj99 https://packagist.org/packages/prestashop/ps_emailsubscription • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2021-21398 – Possible XSS injection through DataColumn Grid class
https://notcve.org/view.php?id=CVE-2021-21398
PrestaShop is a fully scalable open source e-commerce solution. In PrestaShop before version 1.7.7.3, an attacker can inject HTML when the Grid Column Type DataColumn is badly used. The problem is fixed in 1.7.7.3 PrestaShop es una solución de comercio electrónico de código abierto totalmente escalable. En PrestaShop versiones anteriores a 1.7.7.3, un atacante puede inyectar HTML cuando el Grid Column Type DataColumn es usada incorrectamente. El problema se soluciona en la versión 1.7.7.3 • https://github.com/PrestaShop/PrestaShop/commit/aaaba8177f3b3c510461b5e3249e30e60f900205 https://github.com/PrestaShop/PrestaShop/releases/tag/1.7.7.3 https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-fhhq-4x46-qx77 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2021-21308 – Improper session management for soft logout
https://notcve.org/view.php?id=CVE-2021-21308
PrestaShop is a fully scalable open source e-commerce solution. In PrestaShop before version 1.7.2 the soft logout system is not complete and an attacker is able to foreign request and executes customer commands. The problem is fixed in 1.7.7.2 PrestaShop es una solución de comercio electrónico de código abierto totalmente escalable. En PrestaShop versiones anteriores a 1.7.2, el sistema de cierre de sesión suave no está completo y un atacante puede realizar peticiones externas y ejecutar comandos del cliente. El problema es corregido en versión 1.7.7.2 • https://github.com/PrestaShop/PrestaShop/commit/2f673bd93e313f08c35e74decc105f40dc0b7dee https://github.com/PrestaShop/PrestaShop/releases/tag/1.7.7.2 https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-557h-hf3c-whcg • CWE-287: Improper Authentication •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 0CVE-2021-21302 – CSV Injection via csv export
https://notcve.org/view.php?id=CVE-2021-21302
PrestaShop is a fully scalable open source e-commerce solution. In PrestaShop before version 1.7.2 there is a CSV Injection vulnerability possible by using shop search keywords via the admin panel. The problem is fixed in 1.7.7.2 PrestaShop es una solución de comercio electrónico de código abierto totalmente escalable. En PrestaShop versiones anteriores a 1.7.2, se presenta una posible vulnerabilidad de inyección de CSV al usar de palabras clave de búsqueda de la tienda por medio del panel de administración. El problema es corregido en versión 1.7.7.2 • https://github.com/PrestaShop/PrestaShop/commit/782b1368aa4e94dafe28f57485bffbd8893fbb1e https://github.com/PrestaShop/PrestaShop/releases/tag/1.7.7.2 https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-2rw4-2p99-cmx9 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE-1236: Improper Neutralization of Formula Elements in a CSV File •