CVE-2023-39529

PrestaShop prior to version 8.1.1 is vulnerable to an issue where a file on the server can be deleted through the Attachments controller and the Attachments API. The root cause is an improper handling in the attachments logic that permits deletion of server files. Version 8.1.1 contains a patch t...

CVE-2023-39528 PrestaShop vulnerable to file reading through path traversal

PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, the displayAjaxEmailHTML method can be used to read any file on the server, potentially even outside of the project if the server is not correctly configured. Version 8.1.1 contains a patch for this issue. There are ...

CVE-2023-39528 PrestaShop vulnerable to file reading through path traversal

PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, the displayAjaxEmailHTML method can be used to read any file on the server, potentially even outside of the project if the server is not correctly configured. Version 8.1.1 contains a patch for this issue. There are ...

CVE-2023-39528 PrestaShop vulnerable to file reading through path traversal

PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, the displayAjaxEmailHTML method can be used to read any file on the server, potentially even outside of the project if the server is not correctly configured. Version 8.1.1 contains a patch for this issue. There are ...

CVE-2023-39527

PrestaShop XSS via Validate::isCleanHTML. Affected versions are prior to 1.7.8.10, 8.0.5, and 8.1.1; these are vulnerable to cross-site scripting through isCleanHTML. Patches exist in 1.7.8.10, 8.0.5, and 8.1.1. No exploitation details are provided in the supplied documents. Remediation: upgrade ...

CVE-2023-39527 PrestaShop XSS vulnerability through Validate::isCleanHTML method

PrestaShop is an open source e-commerce web application. Versions prior to 1.7.8.10, 8.0.5, and 8.1.1 are vulnerable to cross-site scripting through the isCleanHTML method. Versions 1.7.8.10, 8.0.5, and 8.1.1 contain a patch. There are no known workarounds...

CVE-2023-39526 PrestaShopSQL manager vulnerability (potential RCE)

PrestaShop is an open source e-commerce web application. Versions prior to 1.7.8.10, 8.0.5, and 8.1.1 are vulnerable to remote code execution through SQL injection and arbitrary file write in the back office. Versions 1.7.8.10, 8.0.5, and 8.1.1 contain a patch. There are no known workarounds...

CVE-2023-39526

PrestaShop has a CVE-2023-39526 vulnerability: remote code execution via SQL injection and arbitrary file write in the back office. Affected versions are before 1.7.8.10, 8.0.5, and 8.1.1; these versions contain patches. The advisory references indicate a fix in those versions, with no publicly d...

CVE-2023-39525

Summary: CVE-2023-39525 affects PrestaShop prior to version 8.1.1, where an improper validation in the back office import file deletion query allows path traversal to compromise files. Root cause: path traversal vulnerability in the file deletion/import handling (no details on exact vulnerable fi...

CVE-2023-39525 PrestaShop vulnerable to path traversal

PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, in the back office, files can be compromised using path traversal by replaying the import file deletion query with a specified file path that uses the traversal path. Version 8.1.1 contains a patch for this issue...

CVE-2023-39525 PrestaShop vulnerable to path traversal

PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, in the back office, files can be compromised using path traversal by replaying the import file deletion query with a specified file path that uses the traversal path. Version 8.1.1 contains a patch for this issue...

CVE-2023-39524

PrestaShop is an open‑source e‑commerce platform vulnerable to an SQL injection in the product search field on the back‑office product page, prior to version 8.1.1. The issue is fixed in 8.1.1; no publicly documented exploits or workarounds are specified in the provided sources. Affected componen...

Web Application Firewall is blocking a valid image upload

We have observed that files with signature numbers starting with "FFD8 FFE0" are allowed through the Web Application Firewall WAF, but files with signature numbers starting with "FFD8 FFE1" are getting blocked...

Freewill Solutions IFIS new trading web application vulnerable to unauthenticated remote code execution

Overview Freewill Solutions IFIS new trading web application version 20.01.01.04 is vulnerable to unauthenticated remote code execution. Successful exploitation of this vulnerability allows an attacker to run arbitrary shell commands on the affected host. Description Freewill Solutions IFIS new...

.NET Core OData Denial of Service Vulnerability - Windows

.NET Core is prone to a denial of service vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:microsoft:asp.netcore";...

Web Application Scanner

Binary data was.nbin...

Campcodes Online Matrimonial Website System v3.3 - Code Execution via malicious SVG file upload

Exploit Title: Online Matrimonial Website System v3.3 - Code Execution via malicious SVG file upload Date: 3-8-2023 Category: Web Application Exploit Author: Rajdip Dey Sarkar Version: 3.3 Tested on: Windows/Kali CVE: CVE-2023-39115 Description: ---------------- An arbitrary file upload...

Campcodes Online Matrimonial Website System v3.3 - Code Execution via malicious SVG file upload

Exploit Title: Online Matrimonial Website System v3.3 - Code Execution via malicious SVG file upload Category: Web Application Exploit Author: Rajdip Dey Sarkar Version: 3.3 Tested on: Windows/Kali CVE: CVE-2023-39115 Description: ---------------- An arbitrary file upload vulnerability in Campcod...

Web Wiz Forums 12.06 SQL Injection

==================================================================================================================================== | Title : Web Wiz Forums 12.06 Sql Injection Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 65.0.132-bit...

PHPJabbers Rental Property Booking 2.0 - Reflected XSS

Exploit Title: PHPJabbers Rental Property Booking 2.0 - Reflected XSS Exploit Author: CraCkEr Date: 22/07/2023 Vendor: PHPJabbers Vendor Homepage: https://www.phpjabbers.com/ Software Link: https://www.phpjabbers.com/rental-property-booking-calendar/ Version: 2.0 Tested on: Windows 10 Pro Impact:...