713 matches found
PT-2023-22580 · Prestashop · Prestashop Winbizpayment
Name of the Vulnerable Software and Affected Versions: Prestashop winbizpayment versions 1.0.2 and earlier Description: The issue is related to Incorrect Access Control. It affects the downloads/download.php file in the modules/winbizpayment directory. Recommendations: For Prestashop winbizpaymen...
CVE-2023-30196
Prestashop salesbooster = 1.10.4 is vulnerable to Incorrect Access Control via modules/salesbooster/downloads/download.php...
CVE-2023-30196: Improper Limitation of a Pathname to a Restricted Directory
Prestashop salesbooster = 1.10.4 is vulnerable to Incorrect Access Control via modules/salesbooster/downloads/download.php...
CVE-2023-30196
Prestashop salesbooster = 1.10.4 is vulnerable to Incorrect Access Control via modules/salesbooster/downloads/download.php...
CVE-2023-30199
Prestashop customexporter = 1.7.20 is vulnerable to Incorrect Access Control via modules/customexporter/downloads/download.php...
Improper access control
Prestashop customexporter = 1.7.20 is vulnerable to Incorrect Access Control via modules/customexporter/downloads/download.php...
CVE-2023-30199: Improper Limitation of a Pathname to a Restricted Directory
Prestashop customexporter = 1.7.20 is vulnerable to Incorrect Access Control via modules/customexporter/downloads/download.php...
CVE-2023-30199
Prestashop customexporter = 1.7.20 is vulnerable to Incorrect Access Control via modules/customexporter/downloads/download.php...
Sql injection
OcoMon v4.0 was discovered to contain a SQL injection vulnerability via the cod parameter at download.php...
PT-2022-25839
Name of the Vulnerable Software and Affected Versions OcoMon version 4.0 Description A SQL injection issue was found in OcoMon via the cod parameter at the "download.php" endpoint. This allows for potential exploitation. Recommendations For OcoMon version 4.0, consider restricting access to the...
CVE-2022-41390: Improper Neutralization of Special Elements used in an SQL Command
OcoMon v4.0 was discovered to contain a SQL injection vulnerability via the cod parameter at download.php...
CVE-2022-41390
OcoMon v4.0 was discovered to contain a SQL injection vulnerability via the cod parameter at download.php...
CVE-2022-41390
Summary (CVE-2022-41390): OcoMon v4.0 is affected by a SQL injection vulnerability in the download.php endpoint, triggered via the cod parameter. The issue is described as affecting the ability to inject SQL through this parameter, with the CVSS v3.1 metrics indicating a critical impact (AV:N/AC:...
CVE-2022-41390
OcoMon v4.0 was discovered to contain a SQL injection vulnerability via the cod parameter at download.php...
PT-2022-21903
Name of the Vulnerable Software and Affected Versions MantisBT versions prior to 2.25.5 Description The issue allows remote attackers to attach crafted SVG documents to issue reports or bugnotes. When a user or an admin clicks on the attachment, file download.php opens the SVG document in a brows...
PT-2022-8088
Name of the Vulnerable Software and Affected Versions zzcms version 2019 Description An issue was discovered in the software, which is a SQL injection vulnerability. This vulnerability exists in the /user/dls download.php endpoint when the attacker has dls download authority, and it can be...
PT-2022-8082
Name of the Vulnerable Software and Affected Versions zzcms version 2019 Description An issue exists in zzcms 2019 where SQL Injection is possible in the "dl/dl download.php" endpoint via the id parameter when its value contains a trailing comma. Recommendations For zzcms version 2019, avoid usin...
CVE-2022-29720
74cmsSE v3.5.1 was discovered to contain an arbitrary file read vulnerability via the component \index\controller\Download.php...
CVE-2022-29720
CVE-2022-29720 affects 74cmsSE v3.5.1. A vulnerability in index\controller\Download.php enables an arbitrary file read. Documented references confirm the component and location; no exploit details or remediation are provided in the supplied sources. If applicable, apply vendor advisories or patch...