Mypresta
Monthly
Unauthenticated arbitrary file write in the mypresta Google Merchant Center Feed (gmfeed) module for PrestaShop lets remote attackers control the output filename, path, extension, and content written by the feed.php endpoint, enabling them to drop a PHP file and execute it for remote code execution. The flaw carries a CVSS 4.0 base score of 9.3 (independent assessment: CVSS 3.1 9.3, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflecting no authentication, no user interaction, and full confidentiality, integrity, and availability impact. It affects only PrestaShop stores running this third-party module below version 2.3.9, which is the vendor-fixed release; no public exploit code has been identified at time of analysis and there is no CISA KEV entry, though the trivial unauthenticated exploitation path makes rapid patching advisable.
In the module "Product Tag Icons Pro" (ticons) before 1.8.4 from MyPresta.eu for PrestaShop, a guest can perform SQL injection. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In the module extratabspro before version 2.2.8 from MyPresta.eu for PrestaShop, a guest can perform SQL injection via `extratabspro::searchcategory()`, `extratabspro::searchproduct()` and. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Customer Photo Gallery addon before 2.9.4 for PrestaShop is vulnerable to SQL injection. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
modules/orderfiles/ajax/upload.php in the Customer Files Upload addon 2018-08-01 for PrestaShop (1.5 through 1.7) allows remote attackers to execute arbitrary code by uploading a php file via. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Unauthenticated arbitrary file write in the mypresta Google Merchant Center Feed (gmfeed) module for PrestaShop lets remote attackers control the output filename, path, extension, and content written by the feed.php endpoint, enabling them to drop a PHP file and execute it for remote code execution. The flaw carries a CVSS 4.0 base score of 9.3 (independent assessment: CVSS 3.1 9.3, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflecting no authentication, no user interaction, and full confidentiality, integrity, and availability impact. It affects only PrestaShop stores running this third-party module below version 2.3.9, which is the vendor-fixed release; no public exploit code has been identified at time of analysis and there is no CISA KEV entry, though the trivial unauthenticated exploitation path makes rapid patching advisable.
In the module "Product Tag Icons Pro" (ticons) before 1.8.4 from MyPresta.eu for PrestaShop, a guest can perform SQL injection. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In the module extratabspro before version 2.2.8 from MyPresta.eu for PrestaShop, a guest can perform SQL injection via `extratabspro::searchcategory()`, `extratabspro::searchproduct()` and. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Customer Photo Gallery addon before 2.9.4 for PrestaShop is vulnerable to SQL injection. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
modules/orderfiles/ajax/upload.php in the Customer Files Upload addon 2018-08-01 for PrestaShop (1.5 through 1.7) allows remote attackers to execute arbitrary code by uploading a php file via. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.