253 matches found
PrestaShop-CVE-2018-19126
PrestaShop 后台远程代码执行 CVE-2018-19126 这是 CVE-2018-19126 的概念验证代码，通过串联 PrestaShop 后台多个漏洞，利用 phar 触发反序列化实现远程代码执行。 前提条件： PrestaShop 1.6.x 低于 1.6.1.23 或 1.7.x 低于 1.7.4.4。 后台账户（物流员、翻译员、销售员等）。 PrestaShop 发布说明：http://build.prestashop.com/news/prestashop-1-7-4-4-1-6-1-23-maintenance-releases/...
CVE-2026-89268
QloApps through 1.7.0 renders back-office list filter POST parameters into HTML input value attributes without escaping them in the list helper template. Attackers can induce authenticated users to submit crafted POST requests with malicious payloads to list controllers, executing arbitrary...
EUVD-2026-76773
QloApps through 1.7.0 renders back-office list filter POST parameters into HTML input value attributes without escaping them in the list helper template. Attackers can induce authenticated users to submit crafted POST requests with malicious payloads to list controllers, executing arbitrary...
CVE-2026-89268
QloApps through 1.7.0 contains a reflected cross-site scripting (XSS) vulnerability in the back-office list helper template (list_header.tpl). POST parameters from list filter forms are rendered into HTML value attributes without escaping , allowing an attacker to induce an authenticated user to ...
PT-2026-90554
QloApps through 1.7.0 renders back-office list filter POST parameters into HTML input value attributes without escaping them in the list helper template. Attackers can induce authenticated users to submit crafted POST requests with malicious payloads to list controllers, executing arbitrary...
Zphisher-GUI-Back_office
我的网站：https://microjoan.com 我的YouTube频道：https://www.youtube.com/c/MicroJoan 免责声明 本工具包包含可能对社交媒体具有潜在破坏性或危险性的材料。在访问、使用或以任何其他方式不当利用此工具包之前，请遵守您所在省份/国家的法律。 本工具仅用于教育目的。请勿尝试利用此处包含的内容违反法律。如果您有此意图，请立即离开！ 它仅演示“钓鱼攻击的工作原理”。您不得滥用这些信息来未经授权访问他人的社交媒体。但您可以自行承担风险进行尝试。 Zphisher-GUI-Backoffice...
CVE-2026-89265
MoguBlog through 6.2 contains an authorization bypass vulnerability in the POST /pictureSort/getPictureSortByUid endpoint, which omits the @AuthorityVerify annotation required to enforce role-based permissions. Authenticated back-office users without image-category permissions can supply a catego...
CVE-2026-89265 MoguBlog through 6.2 Missing Authorization on the Admin getPictureSortByUid Endpoint
MoguBlog through 6.2 contains an authorization bypass vulnerability in the POST /pictureSort/getPictureSortByUid endpoint, which omits the @AuthorityVerify annotation required to enforce role-based permissions. Authenticated back-office users without image-category permissions can supply a catego...
PrestaShop - Information Disclosure
User enumeration vulnerability in the AdminLogin controller in PrestaShop 1.7 through 8.2.2 allows remote attackers to obtain administrators user email addresses via manipulation of the idemployee and resettoken parameters. An attacker who has access to the Back Office login URL can trigger the...
CVE-2026-44212
PrestaShop is an open source e-commerce web application. Prior to 8.2.6 and 9.1.1, there is a stored Cross-Site Scripting XSS vulnerability in the PrestaShop back-office Customer Service view. An unauthenticated attacker can submit the public Contact Us form with a malicious email address. The...
Cross-site Scripting (XSS)
PrestaShop is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper sanitization of user-supplied email input in the Contact Us form, which allows an attacker to inject malicious scripts that execute when a back-office employee views the customer service thread...
EUVD-2026-30481
PrestaShop is an open source e-commerce web application. Prior to 8.2.6 and 9.1.1, there is a stored Cross-Site Scripting XSS vulnerability in the PrestaShop back-office Customer Service view. An unauthenticated attacker can submit the public Contact Us form with a malicious email address. The...
CVE-2026-44212
CVE-2026-44212 concerns PrestaShop's back-office Customer Service view. A stored XSS exists where an unauthenticated attacker can submit the public Contact Us form with a malicious email; the payload is stored in the database and executes when a back-office employee opens the affected customer th...
CVE-2026-44212 PrestaShop: Stored XSS executable in customer service view
PrestaShop is an open source e-commerce web application. Prior to 8.2.6 and 9.1.1, there is a stored Cross-Site Scripting XSS vulnerability in the PrestaShop back-office Customer Service view. An unauthenticated attacker can submit the public Contact Us form with a malicious email address. The...
CVE-2026-44212
PrestaShop is an open source e-commerce web application. Prior to 8.2.6 and 9.1.1, there is a stored Cross-Site Scripting XSS vulnerability in the PrestaShop back-office Customer Service view. An unauthenticated attacker can submit the public Contact Us form with a malicious email address. The...
PrestaShop has a stored XSS executable in customer service view
Impact This is a stored Cross-site Scripting XSS vulnerability in the PrestaShop back-office Customer Service view. An unauthenticated attacker can submit the public Contact Us form with a malicious email address. The payload is stored in the database and executed when a back-office employee open...
GHSA-W9F3-QC75-QGX9 PrestaShop has a stored XSS executable in customer service view
Impact This is a stored Cross-site Scripting XSS vulnerability in the PrestaShop back-office Customer Service view. An unauthenticated attacker can submit the public Contact Us form with a malicious email address. The payload is stored in the database and executed when a back-office employee open...
Cross-site Scripting (XSS)
Overview prestashop/prestashop is an Open Source e-commerce platform, committed to providing the best shopping cart experience for both merchants and customers. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Customer Service view process. An attacker can...
PT-2026-39239
Name of the Vulnerable Software and Affected Versions PrestaShop versions prior to 8.2.6 PrestaShop versions prior to 9.1.1 Description A stored Cross-site Scripting XSS issue exists in the back-office Customer Service view. An unauthenticated attacker can submit the public Contact Us form using ...
