CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-21686 – Server Side Twig Template Injection in PrestaShop
https://notcve.org/view.php?id=CVE-2022-21686
PrestaShop is an Open Source e-commerce platform. Starting with version 1.7.0.0 and ending with version 1.7.8.3, an attacker is able to inject twig code inside the back office when using the legacy layout. The problem is fixed in version 1.7.8.3. There are no known workarounds. PrestaShop es una plataforma de comercio electrónico de código abierto. • https://github.com/PrestaShop/PrestaShop/commit/d02b469ec365822e6a9f017e57f588966248bf21 https://github.com/PrestaShop/PrestaShop/releases/tag/1.7.8.3 https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-mrq4-7ch7-2465 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-43789 – Blind SQLi using Search filters in PrestaShop
https://notcve.org/view.php?id=CVE-2021-43789
PrestaShop is an Open Source e-commerce web application. Versions of PrestaShop prior to 1.7.8.2 are vulnerable to blind SQL injection using search filters with `orderBy` and `sortOrder` parameters. The problem is fixed in version 1.7.8.2. PrestaShop es una aplicación web de comercio electrónico de código abierto. Las versiones de PrestaShop anteriores a 1.7.8.2, son vulnerables a una inyección SQL ciega usando filtros de búsqueda con los parámetros "orderBy" y "sortOrder". • https://github.com/numanturle/CVE-2021-43789 https://github.com/PrestaShop/PrestaShop/issues/26623 https://github.com/PrestaShop/PrestaShop/releases/tag/1.7.8.2 https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-6xxj-gcjq-wgf4 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2021-21308 – Improper session management for soft logout
https://notcve.org/view.php?id=CVE-2021-21308
PrestaShop is a fully scalable open source e-commerce solution. In PrestaShop before version 1.7.2 the soft logout system is not complete and an attacker is able to foreign request and executes customer commands. The problem is fixed in 1.7.7.2 PrestaShop es una solución de comercio electrónico de código abierto totalmente escalable. En PrestaShop versiones anteriores a 1.7.2, el sistema de cierre de sesión suave no está completo y un atacante puede realizar peticiones externas y ejecutar comandos del cliente. El problema es corregido en versión 1.7.7.2 • https://github.com/PrestaShop/PrestaShop/commit/2f673bd93e313f08c35e74decc105f40dc0b7dee https://github.com/PrestaShop/PrestaShop/releases/tag/1.7.7.2 https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-557h-hf3c-whcg • CWE-287: Improper Authentication •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 0CVE-2021-21302 – CSV Injection via csv export
https://notcve.org/view.php?id=CVE-2021-21302
PrestaShop is a fully scalable open source e-commerce solution. In PrestaShop before version 1.7.2 there is a CSV Injection vulnerability possible by using shop search keywords via the admin panel. The problem is fixed in 1.7.7.2 PrestaShop es una solución de comercio electrónico de código abierto totalmente escalable. En PrestaShop versiones anteriores a 1.7.2, se presenta una posible vulnerabilidad de inyección de CSV al usar de palabras clave de búsqueda de la tienda por medio del panel de administración. El problema es corregido en versión 1.7.7.2 • https://github.com/PrestaShop/PrestaShop/commit/782b1368aa4e94dafe28f57485bffbd8893fbb1e https://github.com/PrestaShop/PrestaShop/releases/tag/1.7.7.2 https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-2rw4-2p99-cmx9 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE-1236: Improper Neutralization of Formula Elements in a CSV File •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2020-26224 – Improper Access Control in PrestaShop
https://notcve.org/view.php?id=CVE-2020-26224
In PrestaShop before version 1.7.6.9 an attacker is able to list all the orders placed on the website without being logged by abusing the function that allows a shopping cart to be recreated from an order already placed. The problem is fixed in 1.7.6.9. En PrestaShop anterior a versión 1.7.6.9, un atacante es capaz de enumerar todos los pedidos realizados en el sitio web sin estar registrados al abusar de la función que permite a un carrito de compras ser recreado a partir de un pedido ya realizado. El problema se corrigió en la versión 1.7.6.9 • https://github.com/PrestaShop/PrestaShop/commit/709d9afab7bdba1de5d7225a40e4f28c35975909 https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-frf2-c9q3-qg9m • CWE-284: Improper Access Control •