CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 3CVE-2020-21967 – PrestaShop 1.7.6.7 Cross Site Scripting
https://notcve.org/view.php?id=CVE-2020-21967
13 Jul 2022 — File upload vulnerability in the Catalog feature in Prestashop 1.7.6.7 allows remote attackers to run arbitrary code via the add new file page. Una vulnerabilidad en la carga de archivos en la funcionalidad Catalog en Prestashop versión 1.7.6.7 ,permite a atacantes remotos ejecutar código arbitrario por medio de la página add new file PrestaShop version 1.7.6.7 suffers from a cross site scripting vulnerability via the file upload functionality. • https://packetstorm.news/files/id/167742 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-21686 – Server Side Twig Template Injection in PrestaShop
https://notcve.org/view.php?id=CVE-2022-21686
26 Jan 2022 — PrestaShop is an Open Source e-commerce platform. Starting with version 1.7.0.0 and ending with version 1.7.8.3, an attacker is able to inject twig code inside the back office when using the legacy layout. The problem is fixed in version 1.7.8.3. There are no known workarounds. PrestaShop es una plataforma de comercio electrónico de código abierto. • https://github.com/PrestaShop/PrestaShop/commit/d02b469ec365822e6a9f017e57f588966248bf21 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2012-20001
https://notcve.org/view.php?id=CVE-2012-20001
21 Dec 2021 — PrestaShop before 1.5.2 allows XSS via the "<object data='data:text/html" substring in the message field. PrestaShop versiones anteriores a 1.5.2 permite un ataque de tipo XSS por medio de la subcadena "(object data="data:text/html" en el campo del mensaje • https://seclists.org/bugtraq/2012/Nov/1 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-43789 – Blind SQLi using Search filters in PrestaShop
https://notcve.org/view.php?id=CVE-2021-43789
07 Dec 2021 — PrestaShop is an Open Source e-commerce web application. Versions of PrestaShop prior to 1.7.8.2 are vulnerable to blind SQL injection using search filters with `orderBy` and `sortOrder` parameters. The problem is fixed in version 1.7.8.2. PrestaShop es una aplicación web de comercio electrónico de código abierto. Las versiones de PrestaShop anteriores a 1.7.8.2, son vulnerables a una inyección SQL ciega usando filtros de búsqueda con los parámetros "orderBy" y "sortOrder". • https://github.com/numanturle/CVE-2021-43789 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2021-21398 – Possible XSS injection through DataColumn Grid class
https://notcve.org/view.php?id=CVE-2021-21398
30 Mar 2021 — PrestaShop is a fully scalable open source e-commerce solution. In PrestaShop before version 1.7.7.3, an attacker can inject HTML when the Grid Column Type DataColumn is badly used. The problem is fixed in 1.7.7.3 PrestaShop es una solución de comercio electrónico de código abierto totalmente escalable. En PrestaShop versiones anteriores a 1.7.7.3, un atacante puede inyectar HTML cuando el Grid Column Type DataColumn es usada incorrectamente. El problema se soluciona en la versión 1.7.7.3 • https://github.com/PrestaShop/PrestaShop/commit/aaaba8177f3b3c510461b5e3249e30e60f900205 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2021-21308 – Improper session management for soft logout
https://notcve.org/view.php?id=CVE-2021-21308
26 Feb 2021 — PrestaShop is a fully scalable open source e-commerce solution. In PrestaShop before version 1.7.2 the soft logout system is not complete and an attacker is able to foreign request and executes customer commands. The problem is fixed in 1.7.7.2 PrestaShop es una solución de comercio electrónico de código abierto totalmente escalable. En PrestaShop versiones anteriores a 1.7.2, el sistema de cierre de sesión suave no está completo y un atacante puede realizar peticiones externas y ejecutar comandos del clien... • https://github.com/PrestaShop/PrestaShop/commit/2f673bd93e313f08c35e74decc105f40dc0b7dee • CWE-287: Improper Authentication •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 0CVE-2021-21302 – CSV Injection via csv export
https://notcve.org/view.php?id=CVE-2021-21302
26 Feb 2021 — PrestaShop is a fully scalable open source e-commerce solution. In PrestaShop before version 1.7.2 there is a CSV Injection vulnerability possible by using shop search keywords via the admin panel. The problem is fixed in 1.7.7.2 PrestaShop es una solución de comercio electrónico de código abierto totalmente escalable. En PrestaShop versiones anteriores a 1.7.2, se presenta una posible vulnerabilidad de inyección de CSV al usar de palabras clave de búsqueda de la tienda por medio del panel de administración... • https://github.com/PrestaShop/PrestaShop/commit/782b1368aa4e94dafe28f57485bffbd8893fbb1e • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE-1236: Improper Neutralization of Formula Elements in a CSV File •
CVSS: 9.8EPSS: 93%CPEs: 1EXPL: 1CVE-2021-3110
https://notcve.org/view.php?id=CVE-2021-3110
20 Jan 2021 — The store system in PrestaShop 1.7.7.0 allows time-based boolean SQL injection via the module=productcomments controller=CommentGrade id_products[] parameter. El sistema de tienda en PrestaShop versión 1.7.7.0, permite una inyección SQL booleana basada en el tiempo por medio del parámetro id_products[] de module=productcomments controller=CommentGrade • https://medium.com/%40gondaliyajaimin797/cve-2021-3110-75a24943ca5e • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2020-26224 – Improper Access Control in PrestaShop
https://notcve.org/view.php?id=CVE-2020-26224
16 Nov 2020 — In PrestaShop before version 1.7.6.9 an attacker is able to list all the orders placed on the website without being logged by abusing the function that allows a shopping cart to be recreated from an order already placed. The problem is fixed in 1.7.6.9. En PrestaShop anterior a versión 1.7.6.9, un atacante es capaz de enumerar todos los pedidos realizados en el sitio web sin estar registrados al abusar de la función que permite a un carrito de compras ser recreado a partir de un pedido ya realizado. El... • https://github.com/PrestaShop/PrestaShop/commit/709d9afab7bdba1de5d7225a40e4f28c35975909 • CWE-284: Improper Access Control •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2020-15162 – Stored XSS in PrestaShop
https://notcve.org/view.php?id=CVE-2020-15162
24 Sep 2020 — In PrestaShop from version 1.5.0.0 and before version 1.7.6.8, users are allowed to send compromised files. These attachments allowed people to input malicious JavaScript which triggered an XSS payload. The problem is fixed in version 1.7.6.8. En PrestaShop a partir de la versión 1.5.0.0 y antes de la versión 1.7.6.8, los usuarios pueden enviar archivos comprometidos. Estos archivos adjuntos permitieron a la gente introducir JavaScript malicioso que desencadenó una carga útil de XSS. • https://github.com/PrestaShop/PrestaShop/commit/2cfcd33c75974a49f17665f294f228454e14d9cf • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •