CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 1CVE-2018-1000887
https://notcve.org/view.php?id=CVE-2018-1000887
Peel shopping peel-shopping_9_1_0 version contains a Cross Site Scripting (XSS) vulnerability that can result in an authenticated user injecting java script code in the "Site Name EN" parameter. This attack appears to be exploitable if the malicious user has access to the administration account. Peel shopping peel-shopping, en su versión 9.1.0, contiene una vulnerabilidad Cross-Site Scripting (XSS) que puede resultar en que un usuario autenticado inyecte código JavaScript en el parámetro "Site Name EN". El ataque parece ser explotable si el atacante tiene acceso a la cuenta de administrador. • https://github.com/advisto/peel-shopping/issues/1 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 3CVE-2012-5227 – Peel Shopping 2.8/ 2.9 - Cross-Site Scripting / SQL Injections
https://notcve.org/view.php?id=CVE-2012-5227
SQL injection vulnerability in administrer/tva.php in Peel SHOPPING 2.8 and 2.9 allows remote attackers to execute arbitrary SQL commands via the id parameter. Vulnerabilidad de inyección SQL en administrer/tva.php en Peel SHOPPING v2.8 y v2.9, permite a atacantes remotos ejecutar comandos SQL arbitrarios a través del parámetro id. • https://www.exploit-db.com/exploits/18422 http://www.exploit-db.com/exploits/18422 http://www.securityfocus.com/bid/51700 https://exchange.xforce.ibmcloud.com/vulnerabilities/72764 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 3CVE-2012-5226 – Peel Shopping 2.8/ 2.9 - Cross-Site Scripting / SQL Injections
https://notcve.org/view.php?id=CVE-2012-5226
Multiple cross-site scripting (XSS) vulnerabilities in Peel SHOPPING 2.8 and 2.9 allow remote attackers to inject arbitrary web script or HTML via the (1) motclef parameter to achat/recherche.php or (2) PATH_INFO to index.php. Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados (XSS) en Peel SHOPPING v2.8 y v2.9, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del parámetro (1) motclef a achat/recherche.php o (2) PATH_INFO a index.php. • https://www.exploit-db.com/exploits/18422 http://www.exploit-db.com/exploits/18422 http://www.securityfocus.com/bid/51700 https://exchange.xforce.ibmcloud.com/vulnerabilities/72765 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 2CVE-2008-6892 – Peel Shopping 3.1 - 'rubid' SQL Injection
https://notcve.org/view.php?id=CVE-2008-6892
SQL injection vulnerability in lire/index.php in Peel 3.1 allows remote attackers to execute arbitrary SQL commands via the rubid parameter. NOTE: this might be the same issue as CVE-2005-3572. Vulnerabilidad de inyección SQL en lire/index.php en Peel v3.1 permite a atacantes remotos ejecutar comandos SQL de su elección mediante el parámetro "rubid". NOTA: podría tratarse de la misma vulnerabilidad que CVE-2005-3572. • https://www.exploit-db.com/exploits/7395 http://osvdb.org/50604 http://secunia.com/advisories/33073 http://www.securityfocus.com/bid/32715 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.0EPSS: 0%CPEs: 4EXPL: 2CVE-2008-1506 – PEEL CMS 3.x - Admin Hash Extraction / Arbitrary File Upload
https://notcve.org/view.php?id=CVE-2008-1506
PEEL, possibly 3.x and earlier, allows remote attackers to obtain configuration information via a direct request to phpinfo.php, which calls the phpinfo function. PEEL, posiblemente 3.x y versiones anteriores, permite a atacantes remotos obtener información de configuración mediante una petición directa a phpinfo.php, que realiza una llamada a la función phpinfo. • https://www.exploit-db.com/exploits/5281 http://realn.free.fr/releases/70207 https://exchange.xforce.ibmcloud.com/vulnerabilities/41494 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •