Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-30097 State: PUBLISHED Published: 2023-05-04T00:00:00.000Z Last Updated: 2025-01-29T20:44:39.547Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in TotalJS messenger commit b6cf1c9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the private task field. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/totaljs/messenger/issues/9 - https://www.edoardoottavianelli.it/CVE-2023-30097/ - https://www.youtube.com/watch?v=VAlbkvOm_DU
CVE ID: CVE-2023-30106 State: PUBLISHED Published: 2023-04-25T00:00:00.000Z Last Updated: 2025-02-03T17:28:48.908Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sourcecodester Medicine Tracker System in PHP 1.0.0 is vulnerable to Cross Site Scripting (XSS) via page=about. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.sourcecodester.com - https://www.sourcecodester.com/sites/default/files/download/oretnom23/php-mts_0.zip - https://github.com/Rajeshwar40/CVE/blob/main/2023-30106
CVE ID: CVE-2023-30111 State: PUBLISHED Published: 2023-04-25T00:00:00.000Z Last Updated: 2025-02-03T17:27:05.984Z Vendors: n/a Products: n/a Problem Types: n/a Description: Medicine Tracker System in PHP 1.0.0 is vulnerable to Cross Site Scripting (XSS). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.sourcecodester.com/sites/default/files/download/oretnom23/php-mts_0.zip - https://github.com/Rajeshwar40/CVE/blob/main/2023-30111
CVE ID: CVE-2023-30112 State: PUBLISHED Published: 2023-04-26T00:00:00.000Z Last Updated: 2025-02-03T17:47:19.123Z Vendors: n/a Products: n/a Problem Types: n/a Description: Medicine Tracker System in PHP 1.0.0 is vulnerable to SQL Injection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.sourcecodester.com/sites/default/files/download/oretnom23/php-mts_0.zip - https://github.com/Rajeshwar40/CVE/blob/main/CVE-2023-30112
CVE ID: CVE-2023-30122 State: PUBLISHED Published: 2023-05-05T00:00:00.000Z Last Updated: 2025-01-29T17:05:28.137Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in the component /admin/ajax.php?action=save_menu of Online Food Ordering System v2.0 allows attackers to execute arbitrary code via uploading a crafted PHP file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xtxxueyan/bug_report/blob/main/vendors/onetnom23/online-food-ordering-system-v2/RCE-1.md
CVE ID: CVE-2023-30123 State: PUBLISHED Published: 2023-04-28T00:00:00.000Z Last Updated: 2025-01-30T19:39:50.424Z Vendors: n/a Products: n/a Problem Types: n/a Description: wuzhicms v4.1.0 is vulnerable to Cross Site Scripting (XSS) in the Member Center, Account Settings. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/wuzhicms/wuzhicms/issues/205#issue-1635153937
CVE ID: CVE-2023-30124 State: PUBLISHED Published: 2023-05-18T00:00:00.000Z Last Updated: 2025-01-23T19:48:55.743Z Vendors: n/a Products: n/a Problem Types: n/a Description: LavaLite v9.0.0 is vulnerable to Cross Site Scripting (XSS). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/LavaLite/cms/issues/389#issue-1636041104
CVE ID: CVE-2023-30125 State: PUBLISHED Published: 2023-04-28T00:00:00.000Z Last Updated: 2025-01-31T16:03:29.199Z Vendors: n/a Products: n/a Problem Types: n/a Description: EyouCms V1.6.1-UTF8-sp1 is vulnerable to Cross Site Scripting (XSS). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/weng-xianhu/eyoucms/issues/40
CVE ID: CVE-2023-30130 State: PUBLISHED Published: 2023-05-12T00:00:00.000Z Last Updated: 2025-01-24T16:01:00.409Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue found in CraftCMS v.3.8.1 allows a remote attacker to execute arbitrary code via a crafted script to the Section parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://craftcms.com/ - https://tf1t.gitbook.io/mycve/craftcms/server-site-template-injection-on-craftcms-3.8.1
CVE ID: CVE-2023-30131 State: PUBLISHED Published: 2023-10-19T00:00:00 Last Updated: 2024-09-12T20:25:27.310Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue discovered in IXP EasyInstall 6.6.14884.0 allows attackers to run arbitrary commands, gain escalated privilege, and cause other unspecified impacts via unauthenticated API calls. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.bramfitt-tech-labs.com/article/easy-install-cve-issue
CVE ID: CVE-2023-30132 State: PUBLISHED Published: 2023-10-19T00:00:00 Last Updated: 2024-09-12T20:22:58.398Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue discovered in IXP Data EasyInstall 6.6.14907.0 allows attackers to gain escalated privileges via static Cryptographic Key. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.bramfitt-tech-labs.com/article/easy-install-cve-issue
CVE ID: CVE-2023-30135 State: PUBLISHED Published: 2023-05-05T00:00:00.000Z Last Updated: 2025-01-29T17:03:12.620Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC18 v15.03.05.19(6318_)_cn was discovered to contain a command injection vulnerability via the deviceName parameter in the setUsbUnload function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/DrizzlingSun/Tenda/blob/main/AC18/8/8.md
CVE ID: CVE-2023-30145 State: PUBLISHED Published: 2023-05-26T00:00:00 Last Updated: 2025-01-16T16:18:14.452Z Vendors: n/a Products: n/a Problem Types: n/a Description: Camaleon CMS v2.7.0 was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the formats parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://portswigger.net/research/server-side-template-injection - https://book.hacktricks.xyz/pentesting-web/ssti-server-side-template-injection - https://drive.google.com/file/d/11MsSYqUnDRFjcwbQKJeL9Q8nWpgVYf2r/view?usp=share_link - https://github.com/paragbagul111/CVE-2023-30145 - http://packetstormsecurity.co
bQKJeL9Q8nWpgVYf2r/view?usp=share_link - https://github.com/paragbagul111/CVE-2023-30145 - http://packetstormsecurity.com/files/172593/Camaleon-CMS-2.7.0-Server-Side-Template-Injection.html
CVE ID: CVE-2023-30146 State: PUBLISHED Published: 2023-08-04T00:00:00 Last Updated: 2024-10-17T15:32:05.238Z Vendors: n/a Products: n/a Problem Types: n/a Description: Assmann Digitus Plug&View IP Camera HT-IP211HDP, version 2.000.022 allows unauthenticated attackers to download a copy of the camera's settings and the administrator credentials. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://de.assmann.shop/de/Gebaeude-Technik/Sicherheitstechnik/Ueberwachungskameras/ - https://github.com/L1-0/CVE-2023-30146
CVE ID: CVE-2023-30148 State: PUBLISHED Published: 2023-10-14T00:00:00 Last Updated: 2024-09-17T19:55:30.390Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AC:L/AV:N/A:N/C:H/I:H/PR:H/S:U/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple Stored Cross Site Scripting (XSS) vulnerabilities in Opart opartmultihtmlblock before version 2.0.12 and Opart multihtmlblock* version 1.0.0, allows remote authenticated users to inject arbitrary web script or HTML via the body_text or body_text_rude field in /sourcefiles/BlockhtmlClass.php and /sourcefiles/blockhtml.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.friendsofpresta.or
ional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.friendsofpresta.org/modules/2023/10/10/opartmultihtmlblock.html
CVE ID: CVE-2023-30149 State: PUBLISHED Published: 2023-06-02T00:00:00.000Z Last Updated: 2025-01-31T14:56:23.825Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the City Autocomplete (cityautocomplete) module from ebewe.net for PrestaShop, prior to version 1.8.12 (for PrestaShop version 1.5/1.6) or prior to 2.0.3 (for PrestaShop version 1.7), allows remote attackers to execute arbitrary SQL commands via the type, input_name. or q parameter in the autocompletion.php front controller. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://addons.prestashop.com/fr/inscription-processus-de-commande/6097-city-a
r: - CISA ADP Vulnrichment: References: - https://addons.prestashop.com/fr/inscription-processus-de-commande/6097-city-autocomplete.html - https://friends-of-presta.github.io/security-advisories/module/2023/06/01/cityautocomplete.html
CVE ID: CVE-2023-30150 State: PUBLISHED Published: 2023-06-14T00:00:00 Last Updated: 2025-01-06T16:30:48.167Z Vendors: n/a Products: n/a Problem Types: n/a Description: PrestaShop leocustomajax 1.0 and 1.0.0 are vulnerable to SQL Injection via modules/leocustomajax/leoajax.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://friends-of-presta.github.io/security-advisories/module/2023/06/06/leocustomajax.html
CVE ID: CVE-2023-30151 State: PUBLISHED Published: 2023-07-13T00:00:00 Last Updated: 2024-11-04T14:58:11.581Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in the Boxtal (envoimoinscher) module for PrestaShop, after version 3.1.10, allows remote attackers to execute arbitrary SQL commands via the `key` GET parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://help.boxtal.com/hc/fr/articles/360001342977-J-ai-besoin-du-module-PrestaShop-ancienne-version-Boxtal-Envoimoinscher-pour-mon-site - https://addons.prestashop.com/en/shipping-carriers/1755-boxtal-connect-turnkey-shipping-solution.html - http
-mon-site - https://addons.prestashop.com/en/shipping-carriers/1755-boxtal-connect-turnkey-shipping-solution.html - https://security.friendsofpresta.org/module/2023/06/20/envoimoinscher.html
CVE ID: CVE-2023-30153 State: PUBLISHED Published: 2023-07-18T00:00:00 Last Updated: 2024-10-28T18:21:58.936Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An SQL injection vulnerability in the Payplug (payplug) module for PrestaShop, in versions 3.6.0, 3.6.1, 3.6.2, 3.6.3, 3.7.0 and 3.7.1, allows remote attackers to execute arbitrary SQL commands via the ajax.php front controller. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://addons.prestashop.com/en/payment-card-wallet/8795--payplug-accept-customer-payments-wherever-they-are.html - https://security.fri
estashop.com/en/payment-card-wallet/8795--payplug-accept-customer-payments-wherever-they-are.html - https://security.friendsofpresta.org/module/2023/07/18/payplug.html
CVE ID: CVE-2023-30154 State: PUBLISHED Published: 2023-10-14T00:00:00 Last Updated: 2024-09-17T19:49:41.566Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple improper neutralization of SQL parameters in module AfterMail (aftermailpresta) for PrestaShop, before version 2.2.1, allows remote attackers to perform SQL injection attacks via `id_customer`, `id_conf`, `id_product` and `token` parameters in `aftermailajax.php via the 'id_product' parameter in hooks DisplayRightColumnProduct and DisplayProductButtons. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.friendsofpresta.org/modules/2023/10/10/aftermailpresta.html
CVE ID: CVE-2023-30172 State: PUBLISHED Published: 2023-05-11T00:00:00.000Z Last Updated: 2025-01-27T16:51:28.457Z Vendors: n/a Products: n/a Problem Types: n/a Description: A directory traversal vulnerability in the /get-artifact API method of the mlflow platform up to v2.0.1 allows attackers to read arbitrary files on the server via the path parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/mlflow/mlflow/issues/7166 - https://github.com/mlflow/mlflow/issues/7166#issuecomment-1541543234
CVE ID: CVE-2023-30177 State: PUBLISHED Published: 2023-04-25T00:00:00.000Z Last Updated: 2025-02-03T17:25:43.950Z Vendors: n/a Products: n/a Problem Types: n/a Description: CraftCMS 3.7.59 is vulnerable Cross Site Scripting (XSS). An attacker can inject javascript code into Volume Name. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/craftcms/cms/commit/00fb253d5318e10204433e5d93934108e574005e
CVE ID: CVE-2023-30179 State: PUBLISHED Published: 2023-06-13T00:00:00 Last Updated: 2025-01-03T20:04:29.866Z Vendors: n/a Products: n/a Problem Types: n/a Description: CraftCMS version 3.7.59 is vulnerable to Server-Side Template Injection (SSTI). An authenticated attacker can inject Twig Template to User Photo Location field when setting User Photo Location in User Settings, lead to Remote Code Execution. NOTE: the vendor disputes this because only Administrators can add this Twig code, and (by design) Administrators are allowed to do that by default. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/craftcms/cms/blob/develop/CHANG
otes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#442---2023-03-14 - https://datnlq.gitbook.io/cve/craft-cms/cve-2023-30179-server-side-template-injection - https://github.com/github/advisory-database/pull/2443#issuecomment-1610634200 - https://github.com/github/advisory-database/pull/2443#issuecomment-1610040714
CVE ID: CVE-2023-30183 State: REJECTED Published: N/A Last Updated: 2023-05-02T00:00:00 Description: No description available.
CVE ID: CVE-2023-30184 State: PUBLISHED Published: 2023-05-04T00:00:00.000Z Last Updated: 2025-01-29T20:43:32.768Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in Typecho v1.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the url parameter at /index.php/archives/1/comment. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/typecho/typecho/issues/1546
CVE ID: CVE-2023-30185 State: PUBLISHED Published: 2023-05-08T00:00:00.000Z Last Updated: 2025-01-29T20:52:52.500Z Vendors: n/a Products: n/a Problem Types: n/a Description: CRMEB v4.4 to v4.6 was discovered to contain an arbitrary file upload vulnerability via the component \attachment\SystemAttachmentServices.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://crmeb.com - https://www.crmeb.com/ - https://github.com/c7w1n/CVE-2023-30185/blob/main/CVE-2023-30185.md
CVE ID: CVE-2023-30186 State: PUBLISHED Published: 2023-08-14T00:00:00 Last Updated: 2024-10-09T16:18:13.709Z Vendors: n/a Products: n/a Problem Types: n/a Description: A use after free issue discovered in ONLYOFFICE DocumentServer 4.0.3 through 7.3.2 allows remote attackers to run arbitrary code via crafted JavaScript file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ONLYOFFICE/DocumentServer - http://onlyoffice.com - https://github.com/ONLYOFFICE/core/blob/8ca40a44ce47a86168327a46db91253cf6bb205d/DesktopEditor/doctrenderer/ - https://github.com/ONLYOFFICE/core/blob/8ca40a44ce47a86168327a46db91253cf6bb205d/DesktopEditor/doctre
or/doctrenderer/ - https://github.com/ONLYOFFICE/core/blob/8ca40a44ce47a86168327a46db91253cf6bb205d/DesktopEditor/doctrenderer/embed/NativeControlEmbed.cpp#L110 - https://github.com/ONLYOFFICE/core/commit/2b6ad83b36afd9845085b536969d366d1d61150a - https://gist.github.com/merrychap/25eba8c4dd97c9e545edad1b8f0eadc2
CVE ID: CVE-2023-30187 State: PUBLISHED Published: 2023-08-14T00:00:00 Last Updated: 2024-10-09T16:17:27.600Z Vendors: n/a Products: n/a Problem Types: n/a Description: An out of bounds memory access vulnerability in ONLYOFFICE DocumentServer 4.0.3 through 7.3.2 allows remote attackers to run arbitrary code via crafted JavaScript file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ONLYOFFICE/DocumentServer - http://onlyoffice.com - https://github.com/ONLYOFFICE/core/blob/8ca40a44ce47a86168327a46db91253cf6bb205d/DesktopEditor/doctrenderer/ - https://github.com/ONLYOFFICE/core/blob/8ca40a44ce47a86168327a46db91253cf6bb205d/DesktopEd
DesktopEditor/doctrenderer/ - https://github.com/ONLYOFFICE/core/blob/8ca40a44ce47a86168327a46db91253cf6bb205d/DesktopEditor/doctrenderer/embed/NativeControlEmbed.cpp#L110 - https://github.com/ONLYOFFICE/core/commit/2b6ad83b36afd9845085b536969d366d1d61150a - https://gist.github.com/merrychap/25eba8c4dd97c9e545edad1b8f0eadc2
CVE ID: CVE-2023-30188 State: PUBLISHED Published: 2023-08-14T00:00:00 Last Updated: 2024-10-09T16:16:43.528Z Vendors: n/a Products: n/a Problem Types: n/a Description: Memory Exhaustion vulnerability in ONLYOFFICE Document Server 4.0.3 through 7.3.2 allows remote attackers to cause a denial of service via crafted JavaScript file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ONLYOFFICE/DocumentServer - http://onlyoffice.com - https://github.com/ONLYOFFICE/core/blob/8ca40a44ce47a86168327a46db91253cf6bb205d/DesktopEditor/doctrenderer/ - https://github.com/ONLYOFFICE/core/blob/8ca40a44ce47a86168327a46db91253cf6bb205d/DesktopEditor/
opEditor/doctrenderer/ - https://github.com/ONLYOFFICE/core/blob/8ca40a44ce47a86168327a46db91253cf6bb205d/DesktopEditor/doctrenderer/embed/NativeControlEmbed.cpp#L110 - https://github.com/ONLYOFFICE/core/commit/2b6ad83b36afd9845085b536969d366d1d61150a - https://gist.github.com/merrychap/25eba8c4dd97c9e545edad1b8f0eadc2
CVE ID: CVE-2023-30189 State: PUBLISHED Published: 2023-05-16T00:00:00.000Z Last Updated: 2025-01-23T16:10:46.380Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Prestashop posstaticblocks <= 1.0.0 is vulnerable to SQL Injection via posstaticblocks::getPosCurrentHook(). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://friends-of-presta.github.io/security-advisories/modules/2023/04/27/posstaticblocks.html
CVE ID: CVE-2023-30191 State: PUBLISHED Published: 2023-05-17T00:00:00.000Z Last Updated: 2025-01-22T18:03:05.606Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: PrestaShop cdesigner < 3.1.9 is vulnerable to SQL Injection via CdesignerTraitementModuleFrontController::initContent(). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://friends-of-presta.github.io/security-advisories/modules/2023/05/17/cdesigner-89.html
CVE ID: CVE-2023-30192 State: PUBLISHED Published: 2023-05-11T00:00:00.000Z Last Updated: 2025-01-27T16:50:38.254Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Prestashop possearchproducts 1.7 is vulnerable to SQL Injection via PosSearch::find(). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://themeforest.net/user/posthemes/portfolio - https://friends-of-presta.github.io/security-advisories/modules/2023/05/11/possearchproducts.html
CVE ID: CVE-2023-30194 State: PUBLISHED Published: 2023-05-10T00:00:00.000Z Last Updated: 2025-01-27T19:34:54.135Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Prestashop posstaticfooter <= 1.0.0 is vulnerable to SQL Injection via posstaticfooter::getPosCurrentHook(). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://themeforest.net/user/posthemes/portfolio - https://friends-of-presta.github.io/security-advisories/modules/2023/05/09/posstaticfooter.html
CVE ID: CVE-2023-30195 State: PUBLISHED Published: 2023-07-06T00:00:00 Last Updated: 2024-11-20T21:51:05.085Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AC:L/AV:N/A:N/C:H/I:N/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: In the module "Detailed Order" (lgdetailedorder) in version up to 1.1.20 from Linea Grafica for PrestaShop, a guest can download personal informations without restriction formatted in json. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://friends-of-presta.github.io/security-advisories/modules/2023/06/22/lgdetailedorder.html
CVE ID: CVE-2023-30196 State: PUBLISHED Published: 2023-05-30T00:00:00 Last Updated: 2025-01-13T19:57:10.220Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AC:L/AV:N/A:N/C:H/I:N/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Prestashop salesbooster <= 1.10.4 is vulnerable to Incorrect Access Control via modules/salesbooster/downloads/download.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/PrestaShop/PrestaShop/blob/6c05518b807d014ee8edb811041e3de232520c28/classes/Tools.php#L1247 - https://friends-of-presta.github.io/security-advisories/modules/2023/05/22/salesbooster.html
CVE ID: CVE-2023-30197 State: PUBLISHED Published: 2023-05-31T00:00:00 Last Updated: 2025-01-09T21:11:56.298Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AC:L/AV:N/A:N/C:H/I:N/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect Access Control in the module "My inventory" (myinventory) <= 1.6.6 from Webbax for PrestaShop, allows a guest to download personal information without restriction by performing a path traversal attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/PrestaShop/PrestaShop/blob/6c05518b807d014ee8edb811041e3de232520c28/classes/Tools.php#L1247 - https://friends-of-presta.github.io/security-
op/blob/6c05518b807d014ee8edb811041e3de232520c28/classes/Tools.php#L1247 - https://friends-of-presta.github.io/security-advisories/modules/2023/05/30/myinventory.html
CVE ID: CVE-2023-30198 State: PUBLISHED Published: 2023-06-12T00:00:00 Last Updated: 2025-01-06T17:15:45.668Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AC:L/AV:N/A:N/C:H/I:N/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Prestashop winbizpayment <= 1.0.2 is vulnerable to Incorrect Access Control via modules/winbizpayment/downloads/download.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/PrestaShop/PrestaShop/blob/6c05518b807d014ee8edb811041e3de232520c28/classes/Tools.php#L1247 - https://friends-of-presta.github.io/security-advisories/modules/2023/06/08/winbizpayment.html - http://packetstormsecurity.com/file
ends-of-presta.github.io/security-advisories/modules/2023/06/08/winbizpayment.html - http://packetstormsecurity.com/files/173136/PrestaShop-Winbiz-Payment-Improper-Limitation.html
CVE ID: CVE-2023-30199 State: PUBLISHED Published: 2023-05-19T00:00:00 Last Updated: 2025-01-21T19:54:42.076Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AC:L/AV:N/A:N/C:H/I:N/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Prestashop customexporter <= 1.7.20 is vulnerable to Incorrect Access Control via modules/customexporter/downloads/download.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/PrestaShop/PrestaShop/blob/6c05518b807d014ee8edb811041e3de232520c28/classes/Tools.php#L1247 - https://friends-of-presta.github.io/security-advisories/modules/2023/05/16/customexporter.html