CVE-2023-27640

The PrestaShop module tshirtecommerce (Custom Product Designer) version 2.1.4 is affected by a directory traversal vulnerability in the fonts.php endpoint. An attacker can forge HTTP requests using the POST parameter type (and related GET parameters) to traverse the server’s file system and read ...

CVE-2023-27638

The tshirtecommerce (Custom Product Designer) component version 2.1.4 for PrestaShop is vulnerable to unauthenticated SQL injection . An attacker can forge an HTTP request using a compromised tshirtecommerce_design_cart_id GET parameter to exploit insecure parameters in the hookActionCartSave and...

CVE-2023-27637

The tshirtecommerce (Custom Product Designer) component version 2.1.4 for PrestaShop is vulnerable to unauthenticated SQL injection . The root cause is an insecure parameter in the front controller file designer.php, where a forged product_id GET parameter can be used to execute arbitrary SQL que...

CVE-2023-27639

The tshirtecommerce (Custom Product Designer) component version 2.1.4 for PrestaShop is vulnerable to a directory traversal attack. A remote attacker can forge an HTTP request using the file_name parameter in the tshirtecommerce/ajax.php?type=svg endpoint to traverse directories and open arbitrar...