Filtered by vendor Prestashop Subscriptions
Total 122 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2018-19126 1 Prestashop 1 Prestashop 2024-11-21 N/A
PrestaShop 1.6.x before 1.6.1.23 and 1.7.x before 1.7.4.4 allows remote attackers to execute arbitrary code via a file upload.
CVE-2018-19125 1 Prestashop 1 Prestashop 2024-11-21 N/A
PrestaShop 1.6.x before 1.6.1.23 and 1.7.x before 1.7.4.4 allows remote attackers to delete an image directory.
CVE-2018-19124 2 Microsoft, Prestashop 2 Windows, Prestashop 2024-11-21 N/A
PrestaShop 1.6.x before 1.6.1.23 and 1.7.x before 1.7.4.4 on Windows allows remote attackers to write to arbitrary image files.
CVE-2018-13784 1 Prestashop 1 Prestashop 2024-11-21 N/A
PrestaShop before 1.6.1.20 and 1.7.x before 1.7.3.4 mishandles cookie encryption in Cookie.php, Rinjdael.php, and Blowfish.php.
CVE-2018-10942 2 Attribute Wizard Project, Prestashop 2 Attribute Wizard, Prestashop 2024-11-21 N/A
modules/attributewizardpro/file_upload.php in the Attribute Wizard addon 1.6.9 for PrestaShop 1.4.0.1 through 1.6.1.18 allows remote attackers to execute arbitrary code by uploading a .phtml file.
CVE-2015-1175 1 Prestashop 1 Prestashop 2024-11-21 N/A
Cross-site scripting (XSS) vulnerability in blocklayered-ajax.php in the blocklayered module in PrestaShop 1.6.0.9 and earlier allows remote attackers to inject arbitrary web script or HTML via the layered_price_slider parameter.
CVE-2013-6358 1 Prestashop 1 Prestashop 2024-11-21 8.8 High
PrestaShop 1.5.5 allows remote authenticated attackers to execute arbitrary code by uploading a crafted profile and then accessing it in the module/ directory.
CVE-2013-6295 1 Prestashop 1 Prestashop 2024-11-21 9.8 Critical
PrestaShop 1.5.5 vulnerable to privilege escalation via a Salesman account via upload module
CVE-2013-4792 1 Prestashop 1 Prestashop 2024-11-21 5.5 Medium
PrestaShop before 1.4.11 allows logout CSRF.
CVE-2013-4791 1 Prestashop 1 Prestashop 2024-11-21 5.4 Medium
PrestaShop before 1.4.11 allows Logistician, translators and other low level profiles/accounts to inject a persistent XSS vector on TinyMCE.
CVE-2012-6641 1 Prestashop 1 Prestashop 2024-11-21 N/A
Cross-site scripting (XSS) vulnerability in redirect.php in the Socolissimo module (modules/socolissimo/) in PrestaShop before 1.4.7.2 allows remote attackers to inject arbitrary web script or HTML via vectors related to "parameter names and values."
CVE-2012-5801 1 Prestashop 2 Ebay, Prestashop 2024-11-21 N/A
The PayPal module in PrestaShop does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, related to use of the PHP fsockopen function.
CVE-2012-5800 1 Prestashop 2 Ebay Module, Prestashop 2024-11-21 N/A
The eBay module in PrestaShop does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVE-2012-5799 2 Prestashop, Presto-changeo 2 Prestashop, Canadapost 2024-11-21 N/A
The Canada Post (aka CanadaPost) module in PrestaShop does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, related to use of the PHP fsockopen function.
CVE-2012-2517 1 Prestashop 1 Prestashop 2024-11-21 6.1 Medium
Cross-site scripting (XSS) vulnerability in PrestaShop before 1.4.9 allows remote attackers to inject arbitrary web script or HTML via the index of the product[] parameter to ajax.php.
CVE-2012-20001 1 Prestashop 1 Prestashop 2024-11-21 6.1 Medium
PrestaShop before 1.5.2 allows XSS via the "<object data='data:text/html" substring in the message field.
CVE-2011-4545 1 Prestashop 1 Prestashop 2024-11-21 N/A
CRLF injection vulnerability in admin/displayImage.php in Prestashop 1.4.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the name parameter.
CVE-2011-4544 1 Prestashop 1 Prestashop 2024-11-21 N/A
Multiple cross-site scripting (XSS) vulnerabilities in Prestashop before 1.5 allow remote attackers to inject arbitrary web script or HTML via the (1) address or (2) relativ_base_dir parameter to modules/mondialrelay/googlemap.php; the (3) relativ_base_dir, (4) Pays, (5) Ville, (6) CP, (7) Poids, (8) Action, or (9) num parameter to prestashop/modules/mondialrelay/googlemap.php; (10) the num_mode parameter to modules/mondialrelay/kit_mondialrelay/RechercheDetailPointRelais_ajax.php; (11) the Expedition parameter to modules/mondialrelay/kit_mondialrelay/SuiviExpedition_ajax.php; or the (12) folder or (13) name parameter to admin/ajaxfilemanager/ajax_save_text.php.
CVE-2011-3796 1 Prestashop 1 Prestashop 2024-11-21 N/A
PrestaShop 1.4.0.6 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by product-sort.php and certain other files.
CVE-2008-6503 1 Prestashop 1 Prestashop 2024-11-21 N/A
Multiple cross-site scripting (XSS) vulnerabilities in PrestaShop 1.1.0.3 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) admin/login.php and (2) order.php.