CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-31181 – Remote code execution in prestashop
https://notcve.org/view.php?id=CVE-2022-31181
PrestaShop is an Open Source e-commerce platform. In versions from 1.6.0.10 and before 1.7.8.7 PrestaShop is subject to an SQL injection vulnerability which can be chained to call PHP's Eval function on attacker input. The problem is fixed in version 1.7.8.7. Users are advised to upgrade. Users unable to upgrade may delete the MySQL Smarty cache feature. • https://github.com/PrestaShop/PrestaShop/commit/b6d96e7c2a4e35a44e96ffbcdfd34439b56af804 https://github.com/PrestaShop/PrestaShop/releases/tag/1.7.8.7 https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-hrgx-p36p-89q4 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 2CVE-2020-21967 – PrestaShop 1.7.6.7 Cross Site Scripting
https://notcve.org/view.php?id=CVE-2020-21967
File upload vulnerability in the Catalog feature in Prestashop 1.7.6.7 allows remote attackers to run arbitrary code via the add new file page. Una vulnerabilidad en la carga de archivos en la funcionalidad Catalog en Prestashop versión 1.7.6.7 ,permite a atacantes remotos ejecutar código arbitrario por medio de la página add new file PrestaShop version 1.7.6.7 suffers from a cross site scripting vulnerability via the file upload functionality. • http://packetstormsecurity.com/files/167742/PrestaShop-1.7.6.7-Cross-Site-Scripting.html https://github.com/PrestaShop/PrestaShop/issues/20306 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 1%CPEs: 1EXPL: 3CVE-2022-31101 – SQL Injection in prestashop/blockwishlist
https://notcve.org/view.php?id=CVE-2022-31101
prestashop/blockwishlist is a prestashop extension which adds a block containing the customer's wishlists. In affected versions an authenticated customer can perform SQL injection. This issue is fixed in version 2.1.1. Users are advised to upgrade. There are no known workarounds for this issue. prestashop/blockwishlist es una extensión de prestashop que añade un bloque que contiene las listas de deseos del cliente. • https://www.exploit-db.com/exploits/51001 https://github.com/karthikuj/CVE-2022-31101 http://packetstormsecurity.com/files/168003/Prestashop-Blockwishlist-2.1.0-SQL-Injection.html https://github.com/PrestaShop/blockwishlist/commit/b3ec4b85af5fd73f74d55390b226d221298ca084 https://github.com/PrestaShop/blockwishlist/security/advisories/GHSA-2jx3-5j9v-prpp • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-21686 – Server Side Twig Template Injection in PrestaShop
https://notcve.org/view.php?id=CVE-2022-21686
PrestaShop is an Open Source e-commerce platform. Starting with version 1.7.0.0 and ending with version 1.7.8.3, an attacker is able to inject twig code inside the back office when using the legacy layout. The problem is fixed in version 1.7.8.3. There are no known workarounds. PrestaShop es una plataforma de comercio electrónico de código abierto. • https://github.com/PrestaShop/PrestaShop/commit/d02b469ec365822e6a9f017e57f588966248bf21 https://github.com/PrestaShop/PrestaShop/releases/tag/1.7.8.3 https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-mrq4-7ch7-2465 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2012-20001
https://notcve.org/view.php?id=CVE-2012-20001
PrestaShop before 1.5.2 allows XSS via the "<object data='data:text/html" substring in the message field. PrestaShop versiones anteriores a 1.5.2 permite un ataque de tipo XSS por medio de la subcadena "(object data="data:text/html" en el campo del mensaje • https://seclists.org/bugtraq/2012/Nov/1 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •