PrestaShop xipblog - SQL Injection

In the blog module xipblog, an anonymous user can perform SQL injection. Even though the module has been patched in version 2.0.1, the version number was not incremented at the time. id: CVE-2023-27847 info: name: PrestaShop xipblog - SQL Injection author: mastercho severity: critical description...

CVE-2026-38725

xipblog module v2.0.1 and before for PrestaShop allows unauthenticated remote attackers to inject arbitrary JavaScript via the name and content parameters in ajax.php. The input is stored in the database without HTML sanitization and rendered in Smarty templates without output escaping, resulting...

CVE-2026-38725

The xipblog module v2.0.1 and before for PrestaShop is vulnerable to Stored Cross-Site Scripting (XSS) . Unauthenticated remote attackers can inject arbitrary JavaScript by providing malicious data via the name and content parameters in ajax.php . Because the input is stored in the database witho...

PT-2026-83131

xipblog module v2.0.1 and before for PrestaShop allows unauthenticated remote attackers to inject arbitrary JavaScript via the name and content parameters in ajax.php. The input is stored in the database without HTML sanitization and rendered in Smarty templates without output escaping, resulting...

CVE-2026-38725

xipblog module v2.0.1 and before for PrestaShop allows unauthenticated remote attackers to inject arbitrary JavaScript via the name and content parameters in ajax.php. The input is stored in the database without HTML sanitization and rendered in Smarty templates without output escaping, resulting...

CVE-2026-38725: Improper Neutralization of Input During Web Page Generation

xipblog module v2.0.1 and before for PrestaShop allows unauthenticated remote attackers to inject arbitrary JavaScript via the name and content parameters in ajax.php. The input is stored in the database without HTML sanitization and rendered in Smarty templates without output escaping, resulting...

CVE-2026-38725

xipblog module v2.0.1 and before for PrestaShop allows unauthenticated remote attackers to inject arbitrary JavaScript via the name and content parameters in ajax.php. The input is stored in the database without HTML sanitization and rendered in Smarty templates without output escaping, resulting...

EUVD-2026-67768

xipblog module v2.0.1 and before for PrestaShop allows unauthenticated remote attackers to inject arbitrary JavaScript via the name and content parameters in ajax.php. The input is stored in the database without HTML sanitization and rendered in Smarty templates without output escaping, resulting...

CVE-2023-27847

SQL injection vulnerability found in PrestaShop xipblog v.2.0.1 and before allow a remote attacker to gain privileges via the xipcategoryclass and xippostsclass components...

CVE-2023-27847

SQL injection vulnerability found in PrestaShop xipblog v.2.0.1 and before allow a remote attacker to gain privileges via the xipcategoryclass and xippostsclass components...

CVE-2023-27847

SQL injection vulnerability found in PrestaShop xipblog v.2.0.1 and before allow a remote attacker to gain privileges via the xipcategoryclass and xippostsclass components...

Sql injection

SQL injection vulnerability found in PrestaShop xipblog v.2.0.1 and before allow a remote attacker to gain privileges via the xipcategoryclass and xippostsclass components...

CVE-2023-27847

SQL injection vulnerability found in PrestaShop xipblog v.2.0.1 and before allow a remote attacker to gain privileges via the xipcategoryclass and xippostsclass components...

PT-2023-21372 · Prestashop · Prestashop Xipblog

Name of the Vulnerable Software and Affected Versions: PrestaShop xipblog versions 2.0.1 and earlier Description: A SQL injection issue allows a remote attacker to gain privileges via the xipcategoryclass and xippostsclass components. Recommendations: For PrestaShop xipblog versions 2.0.1 and...

CVE-2023-27847

Summary of CVE-2023-27847 (PrestaShop xipblog) An SQL injection exists in PrestaShop xipblog module, affecting versions 2.0.1 and earlier. According to the Nuclei template, an anonymous user can exploit the vulnerability via the region-specific components xipcategoryclass and xippostsclass to exe...

CVE-2023-27847: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability found in PrestaShop xipblog v.2.0.1 and before allow a remote attacker to gain privileges via the xipcategoryclass and xippostsclass components...

PrestaShop SQL注入漏洞

PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution provides a variety of payment methods, SMS alerts and product image scaling and other features. A security vulnerability exists in PrestaShop xipblog version v.2.0.1 and earlier versions, whi...

CVE-2023-27847

SQL injection vulnerability found in PrestaShop xipblog v.2.0.1 and before allow a remote attacker to gain privileges via the xipcategoryclass and xippostsclass components...