473 matches found
PrestaShop-CVE-2018-19126
PrestaShop Back Office Remote Code Execution CVE-2018-19126 This is the PoC for CVE-2018-19126, chaining multiple vulnerabilities in PrestaShop Back Office to trigger deserialization via phar to achieve remote code execution. Prerequisite: PrestaShop 1.6.x before 1.6.1.23 or 1.7.x before 1.7.4.4...
Zphisher-GUI-Back_office
Mi website: https://microjoan.com My YouTube Channel: https://www.youtube.com/c/MicroJoan DISCLAIMER This toolkit contains materials that can be potentially damaging or dangerous for social media. Refer to the laws in your province/country before accessing, using,or in any other way utilizing thi...
EUVD-2026-125191
Vvveb through 1.0.8.6 contains an SQL injection vulnerability because the @KEYS:each macro emits PHP array keys as backtick-quoted INSERT column names without escaping, and several procedures in admin/sql/mysqli/product.sql and adminauthtoken.sql omit the @FILTER guard. Authenticated back-office...
CVE-2026-126374
The Vvveb application (versions through 1.0.8.6 ) is vulnerable to an SQL injection flaw. The root cause is that the @KEYS(:each) macro emits PHP array keys as backtick-quoted INSERT column names without proper escaping. Additionally, certain procedures in admin/sql/mysqli/product.sql and admin_a...
Exploit for CVE-2026-44212
PS17-SEC — unofficial security patches for PrestaShop 1.7 Fre...
CVE-2026-124916
PrestaShop contains an authenticated PHP code injection vulnerability in the back-office Performance debug-mode configuration. A back-office user with permission to modify debug settings can supply a crafted debugcookiename or debugcookievalue that is written without sufficient escaping into a PH...
CVE-2026-124916
PrestaShop contains an authenticated PHP code injection vulnerability within the back-office Performance debug-mode configuration . The root cause is that the application fails to adequately escape or sanitize user-controlled values for debug_cookie_name and debug_cookie_value before writing them...
CVE-2026-124916 PrestaShop Performance Debug Configuration PHP Code Injection
PrestaShop contains an authenticated PHP code injection vulnerability in the back-office Performance debug-mode configuration. A back-office user with permission to modify debug settings can supply a crafted debugcookiename or debugcookievalue that is written without sufficient escaping into a PH...
EUVD-2026-120080
PrestaShop contains an authenticated PHP code injection vulnerability in the back-office Performance debug-mode configuration. A back-office user with permission to modify debug settings can supply a crafted debugcookiename or debugcookievalue that is written without sufficient escaping into a PH...
PT-2026-140429
PrestaShop contains an authenticated PHP code injection vulnerability in the back-office Performance debug-mode configuration. A back-office user with permission to modify debug settings can supply a crafted debug cookie name or debug cookie value that is written without sufficient escaping into ...
PrestaShop debug mode configuration allows PHP code injection
Overview PrestaShop's back-office Performance Debug mode functionality contains a PHP code injection vulnerability. An authenticated attacker with permission to modify debug-mode configuration can submit crafted cookie configuration values that are written into an executable PHP configuration fil...
CVE-2026-124916: PrestaShop: PrestaShop contains an authenticated PHP code injection vulnerability in the back-office Performance debug-mode…
PrestaShop contains an authenticated PHP code injection vulnerability in the back-office Performance debug-mode configuration. A back-office user with permission to modify debug settings can supply a crafted debugcookiename or debugcookievalue that is written without sufficient escaping into a PH...
CVE-2026-122032
SPIP before 4.4.29 contains a SQL injection vulnerability that allows authenticated attackers with back-office access to inject arbitrary SQL by submitting a differing where parameter value in the POST body versus the GET query string on the /ecrire/?exec=articles endpoint, bypassing...
Linux Distros Unpatched Vulnerability : CVE-2026-122032
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SPIP before 4.4.29 contains a SQL injection vulnerability that allows authenticated attackers with back- office access to inject arbitrary SQL by submitting a...
CVE-2026-122032
SPIP before 4.4.29 contains a SQL injection vulnerability that allows authenticated attackers with back-office access to inject arbitrary SQL by submitting a differing where parameter value in the POST body versus the GET query string on the /ecrire/?exec=articles endpoint, bypassing...
DEBIAN-CVE-2026-122032
SPIP before 4.4.29 contains a SQL injection vulnerability that allows authenticated attackers with back-office access to inject arbitrary SQL by submitting a differing where parameter value in the POST body versus the GET query string on the /ecrire/?exec=articles endpoint, bypassing...
CVE-2026-122032 SPIP before 4.4.29 Authenticated SQL Injection via where Parameter
SPIP before 4.4.29 contains a SQL injection vulnerability that allows authenticated attackers with back-office access to inject arbitrary SQL by submitting a differing where parameter value in the POST body versus the GET query string on the /ecrire/?exec=articles endpoint, bypassing...
CVE-2026-122032 SPIP before 4.4.29 Authenticated SQL Injection via where Parameter
SPIP before 4.4.29 contains a SQL injection vulnerability that allows authenticated attackers with back-office access to inject arbitrary SQL by submitting a differing where parameter value in the POST body versus the GET query string on the /ecrire/?exec=articles endpoint, bypassing...
CVE-2026-122032
SPIP versions prior to 4.4.29 are vulnerable to an Authenticated SQL Injection flaw on the /ecrire/?exec=articles endpoint. The vulnerability is caused by a request parameter mismatch where a differing where parameter value provided in the POST body versus the GET query string allows attackers to...
EUVD-2026-116939
SPIP before 4.4.29 contains a SQL injection vulnerability that allows authenticated attackers with back-office access to inject arbitrary SQL by submitting a differing where parameter value in the POST body versus the GET query string on the /ecrire/?exec=articles endpoint, bypassing...