PrestaShop CoinGate Plugin 安全漏洞

PrestaShop CoinGate Plugin is an open source plugin for CoinGate. A security vulnerability exists in PrestaShop CoinGate Plugin 1.2.7 and earlier versions, which stems from the postProcess function in the file modules/coingate/controllers/front/callback.php that can cause business logic errors...

PT-2024-26284 · Channable · Channable

Name of the Vulnerable Software and Affected Versions: Channable for PrestaShop versions up to 3.2.1 Description: The issue allows a guest to perform SQL injection via the ChannableFeedModuleFrontController::postProcess function. Recommendations: For versions up to 3.2.1, consider disabling the...

CVE-2024-34994: Improper Neutralization of Special Elements used in an SQL Command

In the module "Channable" channable up to version 3.2.1 from Channable for PrestaShop, a guest can perform SQL injection via ChannableFeedModuleFrontController::postProcess...

Local File Inclusion (LFI)

gradio is vulnerable to Local File Inclusion LFI. The vulnerability is due to improper input validation in the postprocess function within jsoncomponent.py, where a user-controlled string is parsed as JSON which can be exploited to read arbitrary files on the remote system...

PYSEC-2024-184

A local file inclusion vulnerability exists in the JSON component of gradio-app/gradio version 4.25. The vulnerability arises from improper input validation in the postprocess function within gradio/components/jsoncomponent.py, where a user-controlled string is parsed as JSON. If the parsed JSON...

CVE-2024-4941

The CVE-2024-4941 issue affects gradio-app/gradio v4.25, specifically the JSON component. The root cause is improper input validation in gradio/components/json_component.py: a user-controlled string is parsed as JSON in postprocess(), and if a dict contains a path key, processing_utils.move_files...

CVE-2024-4941 Local File Inclusion in JSON component in gradio-app/gradio

A local file inclusion vulnerability exists in the JSON component of gradio-app/gradio version 4.25. The vulnerability arises from improper input validation in the postprocess function within gradio/components/jsoncomponent.py, where a user-controlled string is parsed as JSON. If the parsed JSON...

Gradio Input Validation Error Vulnerability

Gradio is an open source Python library that is a way to demonstrate machine learning models through a friendly web interface. An input validation error vulnerability exists in Gradio version 4.25, which stems from improper input validation in the postprocess function, where the path field can be...

CVE-2024-4941: Improper Limitation of a Pathname to a Restricted Directory

A local file inclusion vulnerability exists in the JSON component of gradio-app/gradio version 4.25. The vulnerability arises from improper input validation in the postprocess function within gradio/components/jsoncomponent.py, where a user-controlled string is parsed as JSON. If the parsed JSON...

CVE-2024-28393: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in scalapay v.1.2.41 and before allows a remote attacker to escalate privileges via the ScalapayReturnModuleFrontController::postProcess method...

CVE-2024-26469

Server-Side Request Forgery SSRF vulnerability in Tunis Soft "Product Designer" productdesigner module for PrestaShop before version 1.178.36, allows remote attackers to cause a denial of service DoS and escalate privileges via the url parameter in the postProcess method...

CVE-2024-24302

An issue was discovered in Tunis Soft "Product Designer" productdesigner module for PrestaShop before version 1.178.36, allows remote attackers to execute arbitrary code, escalate privileges, and obtain sensitive information via the postProcess method...

CVE-2024-25842

An issue was discovered in Presta World "Account Manager - Sales Representative & Dealers - CRM" prestasalesmanager module for PrestaShop before version 9.0, allows remote attackers to escalate privilege and obtain sensitive information via the uploadLogo and postProcess methods...

CVE-2024-25842

An issue was discovered in Presta World "Account Manager - Sales Representative & Dealers - CRM" prestasalesmanager module for PrestaShop before version 9.0, allows remote attackers to escalate privilege and obtain sensitive information via the uploadLogo and postProcess methods...

PrestaShop Security Breach

PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution provides multiple payment methods, SMS alerts and product image scaling. A security vulnerability previously existed in PrestaShop Product Designer version 1.178.36, which stemmed from a...

PT-2024-20345 · Prestashop · Prestashop Product Designer Module

Name of the Vulnerable Software and Affected Versions: PrestaShop Product Designer module versions prior to 1.178.36 Description: An issue in the Product Designer module for PrestaShop allows remote attackers to execute arbitrary code, escalate privileges, and obtain sensitive information via the...

CVE-2024-25842

An issue was discovered in Presta World "Account Manager - Sales Representative & Dealers - CRM" prestasalesmanager module for PrestaShop before version 9.0, allows remote attackers to escalate privilege and obtain sensitive information via the uploadLogo and postProcess methods...

CVE-2024-25842: Improper Privilege Management

An issue was discovered in Presta World "Account Manager - Sales Representative & Dealers - CRM" prestasalesmanager module for PrestaShop before version 9.0, allows remote attackers to escalate privilege and obtain sensitive information via the uploadLogo and postProcess methods...

CVE-2024-24302

An issue was discovered in Tunis Soft "Product Designer" productdesigner module for PrestaShop before version 1.178.36, allows remote attackers to execute arbitrary code, escalate privileges, and obtain sensitive information via the postProcess method...

CVE-2024-24302: Deserialization of Untrusted Data

An issue was discovered in Tunis Soft "Product Designer" productdesigner module for PrestaShop before version 1.178.36, allows remote attackers to execute arbitrary code, escalate privileges, and obtain sensitive information via the postProcess method...