Exploit for CVE-2026-85520

CVE-2026-85520 — PrestaShop gmfeed unauthenticated arbitrary f...

CVE-2026-85520

Google Merchant Center Feed gmfeed module for PrestaShop is vulnerable to unauthenticated arbitrary file write in the feed.php endpoint. An unauthenticated attacker can send a crafted request that controls the output file name, path, extension, and content through request parameters. Due to the...

CVE-2026-85520 Unauthenticated arbitrary file write leading to RCE in gmfeed PrestaShop module

Google Merchant Center Feed gmfeed module for PrestaShop is vulnerable to unauthenticated arbitrary file write in the feed.php endpoint. An unauthenticated attacker can send a crafted request that controls the output file name, path, extension, and content through request parameters. Due to the...

CVE-2026-85520

The gmfeed (Google Merchant Center Feed) module for PrestaShop is vulnerable to unauthenticated arbitrary file write via the feed.php endpoint. The root cause is a lack of authentication and input validation, which allows an attacker to control the output filename, path, extension, and content th...

CVE-2026-85520 Unauthenticated arbitrary file write leading to RCE in gmfeed PrestaShop module

Google Merchant Center Feed gmfeed module for PrestaShop is vulnerable to unauthenticated arbitrary file write in the feed.php endpoint. An unauthenticated attacker can send a crafted request that controls the output file name, path, extension, and content through request parameters. Due to the...

EUVD-2026-88735

Google Merchant Center Feed gmfeed module for PrestaShop is vulnerable to unauthenticated arbitrary file write in the feed.php endpoint. An unauthenticated attacker can send a crafted request that controls the output file name, path, extension, and content through request parameters. Due to the...

CVE-2026-85520: External Control of File Name or Path

Google Merchant Center Feed gmfeed module for PrestaShop is vulnerable to unauthenticated arbitrary file write in the feed.php endpoint. An unauthenticated attacker can send a crafted request that controls the output file name, path, extension, and content through request parameters. Due to the...

PT-2026-102512

Name of the Vulnerable Software and Affected Versions Google Merchant Center Feed gmfeed module for PrestaShop versions prior to 2.3.9 Description An unauthenticated arbitrary file write exists in the 'feed.php' endpoint. An attacker can send a crafted request to control the output file name, pat...

VulnCheck KEV: CVE-2026-85520

Google Merchant Center Feed gmfeed module for PrestaShop is vulnerable to unauthenticated arbitrary file write in the feed.php endpoint. An unauthenticated attacker can send a crafted request that controls the output file name, path, extension, and content through request parameters. Due to the...

CVE-2020-37051

CVE-2020-37051 affects the Online-Exam-System 2015. A time-based blind SQL injection in the feedback form enables attackers to extract database password hashes via the feed.php endpoint, using crafted time-delayed payloads to enumerate password characters. Reported CVSS metrics (v3.1, base score ...

CVE-2020-37051: Improper Neutralization of Special Elements used in an SQL Command

Online-Exam-System 2015 contains a time-based blind SQL injection vulnerability in the feedback form that allows attackers to extract database password hashes. Attackers can exploit the 'feed.php' endpoint by crafting malicious payload requests that use time delays to systematically enumerate use...

EUVD-2023-49432

Malicious code in bioql PyPI...

CVE-2024-42843

Projectworlds Online Examination System v1.0 is vulnerable to SQL Injection via the subject parameter in feed.php...

CVE-2024-42843

CVE-2024-42843 affects Projectworlds Online Examination System v1.0, with a SQL Injection vulnerability in the subject parameter of feed.php. Multiple connected sources corroborate the issue; no authoritative patch/version is specified in the provided documents. The CVSS metrics indicate a critic...

CVE-2024-42843: Improper Neutralization of Special Elements used in an SQL Command

Projectworlds Online Examination System v1.0 is vulnerable to SQL Injection via the subject parameter in feed.php...

PT-2024-30181 · Unknown · Projectworlds Online Examination System

Name of the Vulnerable Software and Affected Versions: Projectworlds Online Examination System version 1.0 Description: The issue is related to SQL Injection via the subject parameter in feed.php. This allows for potential exploitation. Recommendations: For Projectworlds Online Examination System...

CVE-2024-42843

Projectworlds Online Examination System v1.0 is vulnerable to SQL Injection via the subject parameter in feed.php...

Sql injection

A vulnerability was found in code-projects Fighting Cock Information System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/action/new-feed.php. The manipulation of the argument typefeed leads to sql injection. It is possible to initiate the attack remotel...

CVE-2024-0488 code-projects Fighting Cock Information System new-feed.php sql injection

A vulnerability was found in code-projects Fighting Cock Information System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/action/new-feed.php. The manipulation of the argument typefeed leads to sql injection. It is possible to initiate the attack remotel...

CVE-2024-0488: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in code-projects Fighting Cock Information System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/action/new-feed.php. The manipulation of the argument typefeed leads to sql injection. It is possible to initiate the attack remotel...