Vulnerabilities

TI-2024-16965 CVE-2024-25839 · GHSA-6vrh-rgrg-f5x4

An issue was discovered in Webbax "Super Newsletter" (supernewsletter) module for…

LOW 39

An issue was discovered in Webbax "Super Newsletter" (supernewsletter) module for PrestaShop versions 1.4.21 and before, allows local attackers to escalate privileges and obtain sensitive information.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00453 Published 2024-03-03 No fix listed CWE-200

TI-2023-15166 CVE-2023-31671 · GHSA-7qf2-7386-2j8g

PrestaShop postfinance <= 17.1.13 is vulnerable to SQL Injection via…

MEDIUM 44

PrestaShop postfinance <= 17.1.13 is vulnerable to SQL Injection via PostfinanceValidationModuleFrontController::postProcess().

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0062 Published 2023-06-14 No fix listed CWE-89

TI-2023-14171 CVE-2023-30198 · GHSA-qp5q-f4cm-wxh9

Prestashop winbizpayment <= 1.0.2 is vulnerable to Incorrect Access Control via…

HIGH 66

Prestashop winbizpayment <= 1.0.2 is vulnerable to Incorrect Access Control via modules/winbizpayment/downloads/download.php.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.05523 Published 2023-06-12 No fix listed CWE-22

TI-2023-02838 CVE-2023-3031 · GHSA-7rcp-2v2f-26xw

Prestahop module King-Avis - Path traversal

MEDIUM 56

Improper Limitation of a Pathname leads to a Path Traversal vulnerability in the module King-Avis for Prestashop, allowing a user knowing the download token to read arbitrary local files.This issue affects King-Avis: bef…

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.0079 Published 2023-06-02 Fixed in 17.3.15 CWE-22

TI-2023-14170 CVE-2023-30197 · GHSA-wfvx-vvfq-739j

Incorrect Access Control in the module "My inventory" (myinventory) <= 1.6.6 from Webbax…

MEDIUM 40

Incorrect Access Control in the module "My inventory" (myinventory) <= 1.6.6 from Webbax for PrestaShop, allows a guest to download personal information without restriction by performing a path traversal attack.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00697 Published 2023-05-31 No fix listed CWE-22

TI-2023-14169 CVE-2023-30196 · GHSA-pvfp-mm8f-f953

Prestashop salesbooster <= 1.10.4 is vulnerable to Incorrect Access Control via…

LOW 33

Prestashop salesbooster <= 1.10.4 is vulnerable to Incorrect Access Control via modules/salesbooster/downloads/download.php.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00497 Published 2023-05-30 No fix listed CWE-346

TI-2023-14172 CVE-2023-30199 · GHSA-w7w3-w8qh-fqxr

Prestashop customexporter <= 1.7.20 is vulnerable to Incorrect Access Control via…

LOW 34

Prestashop customexporter <= 1.7.20 is vulnerable to Incorrect Access Control via modules/customexporter/downloads/download.php.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00697 Published 2023-05-19 No fix listed CWE-22