PT-2023-30314 · Unknown · Prestashop

Name of the Vulnerable Software and Affected Versions: PrestaShop versions prior to 5.1.4 Description: The issue affects the blockreassurance module in PrestaShop, which is designed to offer helpful information to reassure customers about the store's trustworthiness. A back-office BO user can...

CVE-2023-43664 Employee without any access rights can list all installed modules in Prestashop

PrestaShop is an Open Source e-commerce web application. In the Prestashop Back office interface, an employee can list all modules without any access rights: method ajaxProcessGetPossibleHookingListForModule doesn't check access rights. This issue has been addressed in commit 15bd281c which is...

CVE-2023-43664

CVE-2023-43664 affects PrestaShop: in the Back Office, an employee can list all modules due to missing access rights check in ajaxProcessGetPossibleHookingListForModule. The root cause is improper authorization in that function. The issue is mitigated in commit 15bd281c and is included in PrestaS...

PT-2023-28909 · Unknown · Prestashop

Name of the Vulnerable Software and Affected Versions: PrestaShop versions prior to 8.1.2 Description: The issue concerns the PrestaShop Back office interface, where an employee can list all modules without any access rights due to the method ajaxProcessGetPossibleHookingListForModule not checkin...

GHSA-M9R4-3FG7-PQM2 PrestaShop path traversal

Impact In the back office, files can be compromised using path traversal by replaying the import file deletion query with a specified file path, using traversal path. Patches 8.1.1 Found by Aleksey Solovev Positive Technologies Workarounds none References none...

PrestaShop path traversal

Impact In the back office, files can be compromised using path traversal by replaying the import file deletion query with a specified file path, using traversal path. Patches 8.1.1 Found by Aleksey Solovev Positive Technologies Workarounds none References none...

CVE-2023-39525 PrestaShop vulnerable to path traversal

PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, in the back office, files can be compromised using path traversal by replaying the import file deletion query with a specified file path that uses the traversal path. Version 8.1.1 contains a patch for this issue...

PT-2023-26995 · Unknown · Prestashop

Name of the Vulnerable Software and Affected Versions: PrestaShop versions prior to 8.1.1 Description: PrestaShop is an open source e-commerce web application. SQL injection is possible in the product search field, in the Back Office's product page. Recommendations: For PrestaShop versions prior ...

PT-2023-26997 · Unknown · Prestashop

Name of the Vulnerable Software and Affected Versions: PrestaShop versions prior to 1.7.8.10 PrestaShop versions prior to 8.0.5 PrestaShop versions prior to 8.1.1 Description: PrestaShop is an open source e-commerce web application. The issue concerns remote code execution through SQL injection a...

Information Exposure

Overview UmbracoCms.IdentityExtensions is a Code files & installation that enables easy extensibility points for ASP.Net Identity and the Umbraco back office. Affected versions of this package are vulnerable to Information Exposure. Client secrets are not required which may expose some endpoints ...

PT-2023-22994 · Unknown · Prestashop

Name of the Vulnerable Software and Affected Versions: PrestaShop versions prior to 8.0.4 PrestaShop versions prior to 1.7.8.9 Description: The issue concerns a SQL filtering vulnerability, allowing a BO user to write, update, and delete in the database, even without having specific rights. There...

Zphisher-GUI-Back_office - A Zphisher GUI Back-Office Plugin

DISCLAIMER This toolkit contains materials that can be potentially damaging or dangerous for social media. Refer to the laws in your province/country before accessing, using,or in any other way utilizing this in a wrong way. This Tool is made for educational purposes only. Do not attempt to viola...

GHSA-MRQ4-7CH7-2465 Server Side Twig Template Injection

PrestaShop is an Open Source e-commerce platform. Starting with version 1.7.0.0 and ending with version 1.7.8.3, an attacker is able to inject twig code inside the back office when using the legacy layout. The problem is fixed in version 1.7.8.3. There are no known workarounds...

Code injection

PrestaShop is an Open Source e-commerce platform. Starting with version 1.7.0.0 and ending with version 1.7.8.3, an attacker is able to inject twig code inside the back office when using the legacy layout. The problem is fixed in version 1.7.8.3. There are no known workarounds...

Jinan Speed Information Technology Co., Ltd. building system there are logical flaws vulnerabilities

Jinan Speed Information Technology Co., Ltd. was established in March 2010, the main business includes computer software development; computer graphic design; website construction and so on. Ltd. There is a logic flaw vulnerability in the website building system, which can be exploited by an...

CVE-2020-5266 Stored XSS on back office edit page

In the pslink module for PrestaShop before version 3.1.0, there is a stored XSS when you create or edit a link list block with the title field. The problem is fixed in 3.1.0...

The vulnerability of the Back Office component of the MICROS Retail-J software allows a hacker to disclose protected information.

The vulnerability of the Back Office component of the MICROS Retail-J software is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to disclose sensitive information through HTTP requests...

The vulnerability of the Level 3 Maintenance Functions component of the Oracle Retail Convenience Store Back Office software allows a perpetrator to gain access to protected information, alter file access rights, or cause partial service interruption.

The vulnerability of the Level 3 Maintenance Functions component of Oracle Retail Convenience Store Back Office software is related to lack of access control. Exploiting this vulnerability could allow a malicious actor to gain access to protected information, modify file access rights, or cause...

CVE-2019-2424

Vulnerability in the Oracle Retail Convenience Store Back Office component of Oracle Retail Applications subcomponent: Level 3 Maintenance Functions. The supported version that is affected is 3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to...

CVE-2019-2424

Vulnerability in the Oracle Retail Convenience Store Back Office component of Oracle Retail Applications subcomponent: Level 3 Maintenance Functions. The supported version that is affected is 3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to...