226 matches found
The Better Mega Menu - Moderately critical - Access bypass - SA-CONTRIB-2021-041
This module provides an admin interface for creating drop down menus that combine Drupal menu items with rich media content. This module has a vulnerability whereby users can select blocks as a menu item they don't have permission to view. The vulnerability is mitigated by the fact that it can on...
The Better Mega Menu - Critical - Cross Site Request Forgery - SA-CONTRIB-2021-040
This module provides an admin interface for creating drop down menus that combine Drupal menu items with rich media content. The module does not use CSRF tokens to protect routes for saving menu configurations. This vulnerability can be exploited by an anonymous user...
The Better Mega Menu - Moderately critical - Cross Site Scripting, Information Disclosure, Multiple vulnerabilities - SA-CONTRIB-2021-038
This module provides an admin interface for creating drop down menus that combine Drupal menu items with rich media content. The module does not sanitize values for CSS properties that are added by admins and rendered on the front-end, allowing attackers to inject malicious code into the front-en...
WordPress WP Mega Menu plugin <= 1.4.0 - Arbitrary Post Access vulnerability
Arbitrary Post Access vulnerability discovered by WPScanTeam in WordPress WP Mega Menu plugin versions = 1.4.0. Solution Update the WordPress WP Mega Menu plugin to the latest available version at least 1.4.1...
WordPress WP Mega Menu plugin <= 1.3.9 - Arbitrary Post Access vulnerability
Arbitrary Post Access vulnerability discovered by WPScanTeam in WordPress WP Mega Menu plugin versions = 1.3.9. Solution Update the WordPress WP Mega Menu plugin to the latest available version at least 1.4.0...
WP Mega Menu < 1.4.0 - Unauthenticated Arbitrary Post Access
The plugin does not properly check for capability and CSRF due to a logic flaw, in its exporttheme and exportwpmegamenunavmenu methods, hooked to admininit. As a result, unauthenticated users can call them and access arbitrary post data, including password protected or private ones. PoC Access an...
WP Mega Menu < 1.4.1 - Subscriber+ Arbitrary Post Access
The plugin does not properly check for capability and CSRF due to a logic flaw, in its exporttheme and exportwpmegamenunavmenu methods, hooked as AJAX actions and available to any authenticated users. As a result, low privilege authenticated users such as subscribers can call them and access...
PrestaShop Responsive Mega Menu Module RCE / SQLi Vulnerability
The SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:prestashop:prestashop"; ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.144185"...
PrestaShop Responsive Mega Menu Pro Module SQL Injection Vulnerability
PrestaShop is an open source e-commerce solution from PrestaShop. The solution provides a variety of payment methods , short message alerts and product image scaling and other features.Attribute Wizard addon is one of the product attribute add module.Responsive Mega Menu...
Sql injection
modules/bamegamenu/ajaxphpcode.php in the Responsive Mega Menu Horizontal+Vertical+Dropdown Pro module 1.0.32 for PrestaShop 1.5.5.0 through 1.7.2.5 allows remote attackers to execute a SQL Injection through function calls in the code parameter...
CVE-2018-8824
modules/bamegamenu/ajaxphpcode.php in the Responsive Mega Menu Horizontal+Vertical+Dropdown Pro module 1.0.32 for PrestaShop 1.5.5.0 through 1.7.2.5 allows remote attackers to execute a SQL Injection through function calls in the code parameter...
CVE-2018-8824
The vulnerability CVE-2018-8824 affects the PrestaShop Responsive Mega Menu Pro module version 1.0.32 (for PrestaShop 1.5.5.0–1.7.2.5). The issue is a SQL injection in modules/bamegamenu/ajax_phpcode.php exposed via the code parameter, reported across multiple sources (NVD, CNVD, OSV, OpenVAS) as...
PT-2018-18646
Name of the Vulnerable Software and Affected Versions PrestaShop versions 1.5.5.0 through 1.7.2.5 Responsive Mega Menu Horizontal+Vertical+Dropdown Pro module version 1.0.32 Description The issue allows remote attackers to execute a SQL Injection through function calls in the code parameter of th...
CVE-2018-8824: Improper Neutralization of Special Elements used in an SQL Command
modules/bamegamenu/ajaxphpcode.php in the Responsive Mega Menu Horizontal+Vertical+Dropdown Pro module 1.0.32 for PrestaShop 1.5.5.0 through 1.7.2.5 allows remote attackers to execute a SQL Injection through function calls in the code parameter...
PrestaShop Responsive Mega Menu Pro Module Code Execution Vulnerability
PrestaShop is an open source e-commerce solution from PrestaShop, Inc. The solution provides a variety of payment methods , short message alerts and product image zoom and other features.Responsive Mega Menu Horizontal + Vertical + Dropdown Pro module is used in which a responsive menu module . A...
CVE-2018-8823
modules/bamegamenu/ajaxphpcode.php in the Responsive Mega Menu Horizontal+Vertical+Dropdown Pro module 1.0.32 for PrestaShop 1.5.5.0 through 1.7.2.5 allows remote attackers to execute arbitrary PHP code via the code parameter...
CVE-2018-8823: Improper Control of Generation of Code
modules/bamegamenu/ajaxphpcode.php in the Responsive Mega Menu Horizontal+Vertical+Dropdown Pro module 1.0.32 for PrestaShop 1.5.5.0 through 1.7.2.5 allows remote attackers to execute arbitrary PHP code via the code parameter...
PT-2018-18645
Name of the Vulnerable Software and Affected Versions PrestaShop versions 1.5.5.0 through 1.7.2.5 Responsive Mega Menu Horizontal+Vertical+Dropdown Pro module version 1.0.32 Description The issue allows remote attackers to execute arbitrary PHP code. This is achieved via the code parameter in the...
