CVE-2024-23760

CVE-2024-23760 affects Gambio 4.9.2.0 (and earlier) with cleartext storage of sensitive information in error handling logs (error-handler.log.json and legacy-error-handler.log.txt under the webroot). Root cause is information disclosure via log files exposed in the webroot. Documented impact is i...

CVE-2024-23763

CVE-2024-23763 affects Gambio up to version 4.9.2.0. A SQL Injection flaw exists where an attacker can craft a GET request using modifiers[attribute][] to execute arbitrary SQL commands. Impact per sources: potential data extraction/modification with high severity (CVSS v3.1 base score 9.8). Expl...

Gambio Log Information Disclosure Vulnerability

Gambio is an all-in-one e-commerce solution from Gambio, Inc. A log information disclosure vulnerability exists in Gambio 4.9.2.0 and earlier versions, which originates from a vulnerability that allows attackers to obtain sensitive information via error-handler.log.json and...

CVE-2024-23763

SQL Injection vulnerability in Gambio through 4.9.2.0 allows attackers to run arbitrary SQL commands via crafted GET request using modifiersattribute parameter...

CVE-2024-23761

CVE-2024-23761 affects Gambio, specifically version 4.9.2.0 (and prior per CNNVD/CNNVD-like sources), where a Server Side Template Injection via a crafted smarty email template allows an attacker to execute arbitrary code. The issue is described consistently across Red Hat, NVD, CVE listings, and...

CVE-2024-23761

Server Side Template Injection in Gambio 4.9.2.0 allows attackers to run arbitrary code via crafted smarty email template...

Gambio SQL Injection Vulnerability

Gambio is an all-in-one e-commerce solution from Gambio, Inc. A SQL injection vulnerability exists in Gambio 4.9.2.0 and earlier versions, which stems from a vulnerability that allows an attacker to run arbitrary SQL commands using a crafted GET request via the attribute parameter...

PT-2024-20066 · Gambio · Gambio

Name of the Vulnerable Software and Affected Versions: Gambio versions 4.9.2.0 and earlier Description: The issue allows attackers to run arbitrary SQL commands via a crafted GET request using the modifiersattribute parameter. This enables attackers to potentially extract or modify sensitive data...

CVE-2024-23759

CVE-2024-23759 affects Gambio Online Webshop up to version 4.9.2.0 and earlier. The issue is a deserialization of untrusted data in the Parcelshopfinder/AddAddressBookEntry function, enabling remote attackers to execute arbitrary code via an unauthenticated HTTP POST request. Root cause is insecu...

CVE-2024-23761

Server Side Template Injection in Gambio 4.9.2.0 allows attackers to run arbitrary code via crafted smarty email template...

Gambio Code Issue Vulnerability

Gambio is an all-in-one e-commerce solution from Gambio, Inc. A code issue vulnerability exists in Gambio version 4.9.2.0 and earlier, which stems from the system containing deserialization of untrusted data, allowing an attacker to run arbitrary code via the search parameter in...

CVE-2024-23760

Cleartext Storage of Sensitive Information in Gambio 4.9.2.0 allows attackers to obtain sensitive information via error-handler.log.json and legacy-error-handler.log.txt under the webroot...

CVE-2024-23759

Deserialization of Untrusted Data in Gambio through 4.9.2.0 allows attackers to run arbitrary code via "search" parameter of the Parcelshopfinder/AddAddressBookEntry" function...

Gambio Code Issue Vulnerability

Gambio is an all-in-one e-commerce solution from Gambio, Inc. A code issue vulnerability exists in Gambio 4.9.2.0 and prior versions that stems from allowing an attacker to run arbitrary code via a crafted smarty email template...

CVE-2024-23760

Cleartext Storage of Sensitive Information in Gambio 4.9.2.0 allows attackers to obtain sensitive information via error-handler.log.json and legacy-error-handler.log.txt under the webroot...

CVE-2024-23759

Deserialization of Untrusted Data in Gambio through 4.9.2.0 allows attackers to run arbitrary code via "search" parameter of the Parcelshopfinder/AddAddressBookEntry" function...

CVE-2024-23763

SQL Injection vulnerability in Gambio through 4.9.2.0 allows attackers to run arbitrary SQL commands via crafted GET request using modifiersattribute parameter...

Gambio Code Issue Vulnerability

Gambio is an all-in-one e-commerce solution from Gambio, Inc. A code issue vulnerability exists in Gambio version 4.9.2.0 and prior versions that stems from allowing an attacker to execute arbitrary code by uploading a crafted PHP file...

CVE-2024-23762

Unrestricted File Upload vulnerability in Content Manager feature in Gambio 4.9.2.0 allows attackers to execute arbitrary code via upload of crafted PHP file...

CVE-2024-23762

CVE-2024-23762 affects Gambio 4.9.2.0 Content Manager: Unrestricted File Upload allows uploading a crafted PHP file to execute arbitrary code. CVSSv3.1 base score 7.8 (HIGH); attack vector: LOCAL, attack complexity: LOW, privileges required: LOW, user interaction: NONE, impact on confidentiality,...