cve-2026-32699-facturascripts-nick-bypass

CVE-2026-32699 - FacturaScripts EditUser Nick-Parameter: Fehlerhafte Zugriffskontrolle Broken Access Control Beschreibung Zusammenfassung Die Anwendung validiert den Parameter nick bei einer POST-Anfrage an den EditUser -Controller nicht. Obwohl die Benutzeroberfläche das Bearbeiten dieses Feldes...

CVE-2026-92809

PrestaShop psgdpr versions through 1.4.3 fail to validate that GDPR consent log entries are attributed to the authenticated customer. Authenticated attackers can submit arbitrary customer identifiers to create forged consent records for other customers, corrupting audit logs...

CVE-2026-92809 PrestaShop psgdpr through 1.4.3 GDPR Log Forgery

PrestaShop psgdpr versions through 1.4.3 fail to validate that GDPR consent log entries are attributed to the authenticated customer. Authenticated attackers can submit arbitrary customer identifiers to create forged consent records for other customers, corrupting audit logs...

CVE-2026-92809: Authorization Bypass Through User-Controlled Key

PrestaShop psgdpr versions through 1.4.3 fail to validate that GDPR consent log entries are attributed to the authenticated customer. Authenticated attackers can submit arbitrary customer identifiers to create forged consent records for other customers, corrupting audit logs...

PT-2026-94081

Name of the Vulnerable Software and Affected Versions PrestaShop psgdpr versions prior to 1.4.4 Description The software fails to validate that GDPR consent log entries are attributed to the authenticated customer. This allows authenticated attackers to submit arbitrary customer identifiers to...

CVE-2026-74885

opensslencrypt versions before 1.4.0 contain a logging bug in restorehiddenmodules that logs module counts after clearing, always showing zero restored modules and corrupting audit trails. Additionally, a race condition exists between module hiding and import hook installation where another threa...

FacturaScripts has Insecure Parameter Handling: Unauthorized Modification of Immutable 'nick' Field

Summary The application fails to validate the nick parameter during a POST request to the EditUser controller. Although the UI prevents editing this field, a user can bypass this restriction using a proxy to rename any account including the Administrator. This leads to Broken Access Control and...