CVE-2020-5250

In PrestaShop before version 1.7.6.4, when a customer edits their address, they can freely change the idaddress in the form, and thus steal someone else's address. It is the same with CustomerForm, you are able to change the idcustomer and change all information of all accounts. The problem is...

CVE-2025-0873: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability classified as critical was found in itsourcecode Tailoring Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /customeredit.php. The manipulation of the argument id/address/fullname/phonenumber/email/city/comment leads to sql injection. T...

PT-2020-18344

Name of the Vulnerable Software and Affected Versions PrestaShop versions prior to 1.7.6.4 Description The issue allows a customer to modify the id address when editing their address, potentially leading to the theft of someone else's address. Similarly, with CustomerForm, a customer can change t...

PT-2019-13347

Name of the Vulnerable Software and Affected Versions PrestaShop versions prior to 1.7.6.0 RC2 Description The issue allows an attacker to leak personal customer information due to an Insecure Direct Object Reference vulnerability. This is caused by guessable values sent to the web application...