CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 1CVE-2023-50029
https://notcve.org/view.php?id=CVE-2023-50029
24 Jun 2024 — PHP Injection vulnerability in the module "M4 PDF Extensions" (m4pdf) up to version 3.3.2 from PrestaAddons for PrestaShop allows attackers to run arbitrary code via the M4PDF::saveTemplate() method. Vulnerabilidad de inyección de PHP en el módulo "M4 PDF Extensions" (m4pdf) hasta la versión 3.3.2 de PrestaAddons para PrestaShop permite a los atacantes ejecutar código de su elección a través del método M4PDF::saveTemplate(). • https://github.com/absholi7ly/PHP-Injection-in-M4-PDF-Extensions • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2022-45448 – Cross-site Scripting in M4 PDF plugin for Prestashop sites
https://notcve.org/view.php?id=CVE-2022-45448
20 Sep 2023 — M4 PDF plugin for Prestashop sites, in its 3.2.3 version and before, is vulnerable to an arbitrary HTML Document crafting vulnerability. The resource /m4pdf/pdf.php uses templates to dynamically create documents. In the case that the template does not exist, the application will return a fixed document with a message in mpdf format. An attacker could exploit this vulnerability by inputting a valid HTML/CSS document as the value of the parameter. El complemento M4 PDF para sitios Prestashop, en su versión 3.... • https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-m4-pdf-plugin-prestashop-sites • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-45447 – Path Traversal in M4 PDF plugin for Prestashop sites
https://notcve.org/view.php?id=CVE-2022-45447
20 Sep 2023 — M4 PDF plugin for Prestashop sites, in its 3.2.3 version and before, is vulnerable to a directory traversal vulnerability. The “f” parameter is not properly checked in the resource /m4pdf/pdf.php, returning any file given its relative path. An attacker that exploits this vulnerability could download /etc/passwd from the server if the file exists. El complemento M4 PDF para sitios Prestashop, en su versión 3.2.3 y anteriores, es vulnerable a una vulnerabilidad de Directory Traversal. El parámetro “f” no está... • https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-m4-pdf-plugin-prestashop-sites • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •