EUVD-2023-43350

Malicious code in bioql PyPI...

Default credentials

In the module "CSV Feeds PRO" csvfeeds 2.6.1 from Bl Modules for PrestaShop, a guest can download personal information without restriction. Due to too permissive access control which does not force administrator to use password on feeds, a guest can access exports from the module which can lead t...

CVE-2023-46355

CVE-2023-46355—CSV Feeds PRO (PrestaShop) affects Bl Modules csvfeeds module prior to version 2.6.1. The root cause is overly permissive access control that does not require an administrator to authenticate when accessing feeds, allowing guests to download exports and potentially leak personal da...

CVE-2023-46356

In the module "CSV Feeds PRO" csvfeeds before 2.6.1 from Bl Modules for PrestaShop, a guest can perform SQL injection. The method SearchApiCsv::getProducts has sensitive SQL call that can be executed with a trivial http call and exploited to forge a SQL injection...

CVE-2023-39643

Bl Modules xmlfeeds before v3.9.8 was discovered to contain a SQL injection vulnerability via the component SearchApiXml::Xmlfeeds...

CVE-2023-39643

Bl Modules xmlfeeds before v3.9.8 was discovered to contain a SQL injection vulnerability via the component SearchApiXml::Xmlfeeds...

Sql injection

Bl Modules xmlfeeds before v3.9.8 was discovered to contain a SQL injection vulnerability via the component SearchApiXml::Xmlfeeds...

CVE-2023-39643

PrestaShop xmlfeeds module (Bl Modules) before version 3.9.8 is vulnerable to SQL injection via the component SearchApiXml::Xmlfeeds(). The issue has a very high impact (CVE-2023-39643) with a CVSS v3.1 base score of 9.8 (Network attack, no authentication, user interaction not required). Affected...

PT-2023-27047 · Unknown · Bl Modules Xmlfeeds

Name of the Vulnerable Software and Affected Versions: Bl Modules xmlfeeds versions prior to 3.9.8 Description: The issue is related to a SQL injection vulnerability. It affects the component SearchApiXml::Xmlfeeds. Recommendations: For versions prior to 3.9.8, update to version 3.9.8 or later to...