Security Advisories - prestashop/prestashop

prestashop/prestashop Security Advisories for 1.7.6.3 (17)

PrestaShop allows users to uninstall modules from backoffice, even with low rights

CVE-2023-43663

Affected version: <8.1.2

Reported by:
GitHub
PrestaShop allows employee without any access rights to list all installed modules

CVE-2023-43664

Affected version: <8.1.2

Reported by:
GitHub
PrestaShop file deletion via CustomerMessage

CVE-2023-39530

Affected version: <=8.1.0

Reported by:
GitHub
PrestaShop file deletion via attachment API

CVE-2023-39529

Affected version: <=8.1.0

Reported by:
GitHub
PrestaShop file access through path traversal

CVE-2023-39528

Affected version: <=8.1.0

Reported by:
GitHub
PrestaShop XSS injection through Validate::isCleanHTML method

CVE-2023-39527

Affected version: <1.7.8.10|>=8.0.0,<8.0.5|=8.1.0

Reported by:
GitHub
PrestaShop SQL manager vulnerability

CVE-2023-39526

Affected version: <1.7.8.10|>=8.0.0,<8.0.5|=8.1.0

Reported by:
GitHub
PrestaShop path traversal

CVE-2023-39525

Affected version: <=8.1.0

Reported by:
GitHub
PrestaShop boolean SQL injection

CVE-2023-39524

Affected version: <=8.1.0

Reported by:
GitHub
Arbitrary file read via SQL injection

CVE-2023-30545

Affected version: <1.7.8.9|>=8.0.0,<8.0.4

Reported by:
GitHub
Possible XSS injection through Validate::isCleanHTML method

CVE-2023-30838

Affected version: <1.7.8.9|>=8.0.0,<8.0.4

Reported by:
GitHub
SQL filter bypass leading to arbitrary write requests using "SQL Manager"

CVE-2023-30839

Affected version: <1.7.8.9|>=8.0.0,<8.0.4

Reported by:
GitHub
Possible CSRF token fixation

CVE-2023-25170

Affected version: <8.0.1

Reported by:
GitHub
PrestaShop has potential Information exposure in the upload directory

CVE-2022-46158

Affected version: <1.7.8.8

Reported by:
GitHub
PrestaShop eval injection possible if shop vulnerable to SQL injection

CVE-2022-31181

Affected version: >=1.6.0.10,<1.7.8.7

Reported by:
GitHub
Server Side Twig Template Injection

CVE-2022-21686

Affected version: >=1.7.0.0,<=1.7.8.2

Reported by:
GitHub
SQL injection in prestashop/prestashop

CVE-2021-43789

Affected version: >=1.7.5.0,<=1.7.8.1

Reported by:
GitHub