Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2016-10513: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross Site Scripting (XSS) exists in Piwigo before 2.8.3 via a crafted search expression to include/functions_search.inc.php.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2017-10-10T20:29Z
Repository: https://github.com/Piwigo/Piwigo
Language: PHP
Files changed: include/functions_search.inc.php
Commit date: 2016-11-17 14:10:27 +0100
Commit message: fixes #548, escape HTML chars from search expression

before sending them to HTML comment on frontend

Diff: diff --git a/include/functions_search.inc.php b/include/functions_search.inc.php
index d8df4eea8..59fc97cac 100644
--- a/include/functions_search.inc.php
+++ b/include/functions_search.inc.php
@@ -1282,17 +1282,17 @@ function get_quick_search_results_no_cache($q, $options)
   // allow plugins to evaluate their own scopes
   trigger_notify('qsearch_before_eval', $expression, $qsr);
 
   $ids = qsearch_eval($expression, $qsr, $tmp, $search_results['qs']['unmatched_terms']);
 
-  $debug[] = "<!--\nparsed: ".$expression;
+  $debug[] = "<!--\nparsed: ".htmlspecialchars($expression);
   $debug[] = count($expression->stokens).' tokens';
   for ($i=0; $i<count($expression->stokens); $i++)
   {
-    $debug[] = $expression->stokens[$i].': '.count($qsr->tag_ids[$i]).' tags, '.count($qsr->tag_iids[$i]).' tiids, '.count($qsr->images_iids[$i]).' iiids, '.count($qsr->iids[$i]).' iids'
+    $debug[] = htmlspecialchars($expression->stokens[$i]).': '.count($qsr->tag_ids[$i]).' tags, '.count($qsr->tag_iids[$i]).' tiids, '.count($qsr->images_iids[$i]).' iiids, '.count($qsr->iids[$i]).' iids'
       .' modifier:'.dechex($expression->stoken_modifiers[$i])
-      .( !empty($expression->stokens[$i]->variants) ? ' variants: '.implode(', ',$expression->stokens[$i]->variants): '');
+      .( !empty($expression->stokens[$i]->variants) ? ' variants: '.htmlspecialchars(implode(', ',$expression->stokens[$i]->variants)): '');
   }
   $debug[] = 'before perms '.count($ids);
 
   $search_results['qs']['matching_tags'] = $qsr->all_tags;
   $search_results = trigger_change('qsearch_results', $search_results, $expression, $qsr);

Vulnerable code:   $debug[] = "<!--\nparsed: ".$expression;
    $debug[] = $expression->stokens[$i].': '.count($qsr->tag_ids[$i]).' tags, '.count($qsr->tag_iids[$i]).' tiids, '.count($qsr->images_iids[$i]).' iiids, '.count($qsr->iids[$i]).' iids'
      .( !empty($expression->stokens[$i]->variants) ? ' variants: '.implode(', ',$expression->stokens[$i]->variants): '');
Fixed code:   $debug[] = "<!--\nparsed: ".htmlspecialchars($expression);
    $debug[] = htmlspecialchars($expression->stokens[$i]).': '.count($qsr->tag_ids[$i]).' tags, '.count($qsr->tag_iids[$i]).' tiids, '.count($qsr->images_iids[$i]).' iiids, '.count($qsr->iids[$i]).' iids'
      .( !empty($expression->stokens[$i]->variants) ? ' variants: '.htmlspecialchars(implode(', ',$expression->stokens[$i]->variants)): '');
CVE-2016-10514: Improper Access Control (CWE-284)
value: url_check_format in include/functions.inc.php in Piwigo before 2.8.3 allows remote attackers to bypass intended access restrictions via a URL that contains a " character, or a URL beginning with a substring other than the http:// or https:// substring.
CWE description: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CVSS v3 base score: 6.5
Published: 2017-10-10T20:29Z
Repository: https://github.com/Piwigo/Piwigo
Language: PHP
Files changed: include/functions.inc.php
Commit date: 2016-11-17 13:43:40 +0100
Commit message: fixes #547, strong checks on url format

Diff: diff --git a/include/functions.inc.php b/include/functions.inc.php
index 018747817..39b618d81 100644
--- a/include/functions.inc.php
+++ b/include/functions.inc.php
@@ -2053,10 +2053,20 @@ function mobile_theme()
  * @param string $url
  * @return bool
  */
 function url_check_format($url)
 {
+  if (strpos($url, '"') !== false)
+  {
+    return false;
+  }
+
+  if (strncmp($url, 'http://', 7) !== 0 and strncmp($url, 'https://', 8) !== 0)
+  {
+    return false;
+  }
+
   return filter_var($url, FILTER_VALIDATE_URL, FILTER_FLAG_SCHEME_REQUIRED | FILTER_FLAG_HOST_REQUIRED)!==false;
 }
 
 /**
  * check email format

Fixed code:   if (strpos($url, '"') !== false)
  {
    return false;
  }

  if (strncmp($url, 'http://', 7) !== 0 and strncmp($url, 'https://', 8) !== 0)
  {
    return false;
  }
CVE-2017-10682: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: SQL injection vulnerability in the administrative backend in Piwigo through 2.9.1 allows remote users to execute arbitrary SQL commands via the cat_false or cat_true parameter in the comments or status page to cat_options.php.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2017-06-29T21:29Z
Repository: https://github.com/Piwigo/Piwigo
Language: PHP
Files changed: admin/cat_options.php
Commit date: 2017-06-29 16:24:15 +0200
Commit message: check input parameter for cat_options pages

solving https://github.com/Piwigo/Piwigo/issues/724

Diff: diff --git a/admin/cat_options.php b/admin/cat_options.php
index 042adfe960..5fd4d04ce1 100644
--- a/admin/cat_options.php
+++ b/admin/cat_options.php
@@ -42,10 +42,11 @@ check_status(ACCESS_ADMINISTRATOR);
 if (isset($_POST['falsify'])
     and isset($_POST['cat_true'])
     and count($_POST['cat_true']) > 0)
 {
   check_pwg_token();
+  check_input_parameter('cat_true', $_POST, true, PATTERN_ID);
   switch ($_GET['section'])
   {
     case 'comments' :
     {
       $query = '
@@ -80,10 +81,11 @@ UPDATE '.CATEGORIES_TABLE.'
 }
 else if (isset($_POST['trueify'])
          and isset($_POST['cat_false'])
          and count($_POST['cat_false']) > 0)
 {
+  check_input_parameter('cat_false', $_POST, true, PATTERN_ID);
   switch ($_GET['section'])
   {
     case 'comments' :
     {
       $query = '

Fixed code:   check_input_parameter('cat_true', $_POST, true, PATTERN_ID);
  check_input_parameter('cat_false', $_POST, true, PATTERN_ID);
CVE-2017-5608: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in the image upload function in Piwigo before 2.8.6 allows remote attackers to inject arbitrary web script or HTML via a crafted image filename.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2017-01-28T18:59Z
Repository: https://github.com/Piwigo/Piwigo
Language: PHP
Files changed: action.php, admin/include/functions_upload.inc.php
Commit date: 2017-01-27 11:13:00 +0100
Commit message: fixes #600, avoid html in web uploaded filenames

Diff: diff --git a/action.php b/action.php
index b87e160542..d800e4797a 100644
--- a/action.php
+++ b/action.php
@@ -214,11 +214,11 @@ if (!isset($ctype))
 
 $http_headers[] = 'Content-Type: '.$ctype;
 
 if (isset($_GET['download']))
 {
-  $http_headers[] = 'Content-Disposition: attachment; filename="'.$element_info['file'].'";';
+  $http_headers[] = 'Content-Disposition: attachment; filename="'.htmlspecialchars_decode($element_info['file']).'";';
   $http_headers[] = 'Content-Transfer-Encoding: binary';
 }
 else
 {
   $http_headers[] = 'Content-Disposition: inline; filename="'
diff --git a/admin/include/functions_upload.inc.php b/admin/include/functions_upload.inc.php
index 900612fdde..cedebd14c6 100644
--- a/admin/include/functions_upload.inc.php
+++ b/admin/include/functions_upload.inc.php
@@ -159,10 +159,15 @@ function add_uploaded_file($source_filepath, $original_filename=null, $categorie
   // TODO
   // * check md5sum (already exists?)
 
   global $conf, $user;
 
+  if (!is_null($original_filename))
+  {
+    $original_filename = htmlspecialchars($original_filename);
+  }
+
   if (isset($original_md5sum))
   {
     $md5sum = $original_md5sum;
   }
   else

Vulnerable code:   $http_headers[] = 'Content-Disposition: attachment; filename="'.$element_info['file'].'";';
Fixed code:   $http_headers[] = 'Content-Disposition: attachment; filename="'.htmlspecialchars_decode($element_info['file']).'";';
  if (!is_null($original_filename))
  {
    $original_filename = htmlspecialchars($original_filename);
  }
CVE-2023-37270: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: Piwigo is open source photo gallery software. Prior to version 13.8.0, there is a SQL Injection vulnerability in the login of the administrator screen. The SQL statement that acquires the HTTP Header `User-Agent` is vulnerable at the endpoint that records user information when logging in to the administrator screen. It is possible to execute arbitrary SQL statements. Someone who wants to exploit the vulnerability must be log in to the administrator screen, even with low privileges. Any SQL statement can be executed. Doing so may leak information from the database. Version 13.8.0 contains a fix for this issue. As another mitigation, those who want to execute a SQL statement verbatim with user-enterable parameters should be sure to escape the parameter contents appropriately.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 8.8
Published: 2023-07-07T22:15Z
Repository: https://github.com/Piwigo/Piwigo
Language: PHP
Files changed: include/functions.inc.php
Commit date: 2023-07-07 16:23:49 +0200
Commit message: Merge pull request from GHSA-934w-qj9p-3qcx


Diff: diff --git a/include/functions.inc.php b/include/functions.inc.php
index a6e4d7105f..e5278da7c7 100644
--- a/include/functions.inc.php
+++ b/include/functions.inc.php
@@ -616,11 +616,11 @@ function pwg_activity($object, $object_id, $action, $details=array())
       'action' => $action,
       'performed_by' => $performed_by,
       'session_idx' => $session_id,
       'ip_address' => $ip_address,
       'details' => $details_insert,
-      'user_agent' => $user_agent,
+      'user_agent' => pwg_db_real_escape_string($user_agent),
     );
   }
 
   mass_inserts(ACTIVITY_TABLE, array_keys($inserts[0]), $inserts);
 }

Vulnerable code:       'user_agent' => $user_agent,
Fixed code:       'user_agent' => pwg_db_real_escape_string($user_agent),
CVE-2021-25927: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)
value: Prototype pollution vulnerability in 'safe-flat' versions 2.0.0 through 2.0.1 allows an attacker to cause a denial of service and may lead to remote code execution.
CWE description: The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
CVSS v3 base score: 9.8
Published: 2021-04-26T11:15Z
Repository: https://github.com/jessie-codes/safe-flat
Language: JavaScript
Files changed: src/index.js, test/unflatten.spec.js
Commit date: 2021-01-23 19:14:38 -0500
Commit message: fix(unflat): fix potential for prototype pollution

Diff: diff --git a/src/index.js b/src/index.js
index b6dad85..6d49cb7 100644
--- a/src/index.js
+++ b/src/index.js
@@ -43,17 +43,19 @@ const flatten = (obj, delimiter) => {
 }
 
 const unflatten = (obj, delimiter) => {
   const result = {}
   const seperator = delimiter || defaultDelimiter
+  const proto = ['__proto__', 'constructor', 'prototype']
 
   if (typeof obj !== 'object' || isDate(obj)) return obj
 
   const unflat = (original) => {
     Object.keys(original).forEach((key) => {
       const newKeys = key.split(seperator)
       newKeys.reduce((o, k, i) => {
+        if (proto.includes(newKeys[i])) return o
         return o[k] || (o[k] = isNaN(Number(newKeys[i + 1])) ? (newKeys.length - 1 === i ? original[key] : {}) : [])
       }, result)
     })
   }
 
diff --git a/test/unflatten.spec.js b/test/unflatten.spec.js
index 3c3fd6b..8a703ba 100644
--- a/test/unflatten.spec.js
+++ b/test/unflatten.spec.js
@@ -148,5 +148,17 @@ test('it should handle date objects', (t) => {
     }
   }
 
   t.deepEqual(unflatten(original), expected)
 })
+
+test('it should not pollute the prototype', (t) => {
+  const original = {
+    '__proto__.polluted': 'Attempt to pollute the prototype',
+    'a.prototype.polluted': 'Attempt to pollute the prototype',
+    'a.b': 'This attribute is safe',
+    'c.constructor.polluted': 'Attempt to pollute the prototype',
+    'constructor.polluted': 'Attempt to pollute the prototype'
+  }
+  unflatten(original)
+  t.assert({}.polluted == null)
+})

Fixed code:   const proto = ['__proto__', 'constructor', 'prototype']
        if (proto.includes(newKeys[i])) return o

test('it should not pollute the prototype', (t) => {
  const original = {
    '__proto__.polluted': 'Attempt to pollute the prototype',
    'a.prototype.polluted': 'Attempt to pollute the prototype',
    'a.b': 'This attribute is safe',
    'c.constructor.polluted': 'Attempt to pollute the prototype',
    'constructor.polluted': 'Attempt to pollute the prototype'
  }
  unflatten(original)
  t.assert({}.polluted == null)
})
CVE-2020-11074: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: In PrestaShop from version 1.5.3.0 and before version 1.7.6.6, there is a stored XSS when using the name of a quick access item. The problem is fixed in 1.7.6.6.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2020-07-02T17:15Z
Repository: https://github.com/PrestaShop/PrestaShop
Language: Unknown
Commit date: 2020-06-29 14:30:09 +0200
Commit message: Merge pull request from GHSA-v4pg-q2cv-f7x4

Escape $confirm variable in smarty context
CVE-2020-15079: Insufficient Information (NVD-CWE-noinfo)
value: In PrestaShop from version 1.5.0.0 and before version 1.7.6.6, there is improper access control in Carrier page, Module Manager and Module Positions. The problem is fixed in version 1.7.6.6
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 5.4
Published: 2020-07-02T17:15Z
Repository: https://github.com/PrestaShop/PrestaShop
Language: Unknown
Commit date: 2020-06-29 14:24:09 +0200
Commit message: Merge pull request from GHSA-xp3x-3h8q-c386

Improper access control
CVE-2020-15080: Missing Authorization (CWE-862)
value: In PrestaShop from version 1.7.4.0 and before version 1.7.6.6, some files should not be in the release archive, and others should not be accessible. The problem is fixed in version 1.7.6.6 A possible workaround is to make sure `composer.json` and `docker-compose.yml` are not accessible on your server.
CWE description: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVSS v3 base score: 5.3
Published: 2020-07-02T17:15Z
Repository: https://github.com/PrestaShop/PrestaShop
Language: Unknown
Commit date: 2020-06-29 14:17:04 +0200
Commit message: Merge pull request from GHSA-492w-2pp5-xhvg

Protect the composer.lock file and remove docker-compose.yml in the zip archive
CVE-2020-15081: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: In PrestaShop from version 1.5.0.0 and before 1.7.6.6, there is information exposure in the upload directory. The problem is fixed in version 1.7.6.6. A possible workaround is to add an empty index.php file in the upload directory.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 5.3
Published: 2020-07-02T17:15Z
Repository: https://github.com/PrestaShop/PrestaShop
Language: Unknown
Commit date: 2020-06-29 14:14:02 +0200
Commit message: Merge pull request from GHSA-997j-f42g-x57c

Add missing index.php in upload directory
CVE-2020-15082: Other (NVD-CWE-Other)
value: In PrestaShop from version 1.6.0.1 and before version 1.7.6.6, the dashboard allows rewriting all configuration variables. The problem is fixed in 1.7.6.6
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 8.8
Published: 2020-07-02T17:15Z
Repository: https://github.com/PrestaShop/PrestaShop
Language: Unknown
Commit date: 2020-06-29 14:07:00 +0200
Commit message: Merge pull request from GHSA-mc98-xjm3-c4fm

Remove unwanted update in dashboard controller
CVE-2020-15083: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: In PrestaShop from version 1.7.0.0 and before version 1.7.6.6, if a target sends a corrupted file, it leads to a reflected XSS. The problem is fixed in 1.7.6.6
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2020-07-02T17:15Z
Repository: https://github.com/PrestaShop/PrestaShop
Language: Unknown
Commit date: 2020-06-29 14:26:02 +0200
Commit message: Merge pull request from GHSA-qgh4-95j7-p3vj

Do not append data as html, use text function instead
CVE-2020-15160: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: PrestaShop from version 1.7.5.0 and before version 1.7.6.8 is vulnerable to a blind SQL Injection attack in the Catalog Product edition page with location parameter. The problem is fixed in 1.7.6.8
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2020-09-24T23:15Z
Repository: https://github.com/PrestaShop/PrestaShop
Language: Unknown
Commit date: 2020-09-24 14:45:00 +0200
Commit message: Merge pull request from GHSA-fghq-8h87-826g

Escape location and ids when setting location
CVE-2020-15161: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: In PrestaShop from version 1.6.0.4 and before version 1.7.6.8 an attacker is able to inject javascript while using the contact form. The problem is fixed in 1.7.6.8
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2020-09-24T22:15Z
Repository: https://github.com/PrestaShop/PrestaShop
Language: Unknown
Commit date: 2020-09-24 14:46:39 +0200
Commit message: Merge pull request from GHSA-5cp2-r794-w37w

Don't use htmlentitiesdecode when sending email
CVE-2020-15162: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: In PrestaShop from version 1.5.0.0 and before version 1.7.6.8, users are allowed to send compromised files. These attachments allowed people to input malicious JavaScript which triggered an XSS payload. The problem is fixed in version 1.7.6.8.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2020-09-24T23:15Z
Repository: https://github.com/PrestaShop/PrestaShop
Language: Unknown
Commit date: 2020-09-24 14:47:00 +0200
Commit message: Merge pull request from GHSA-rc8c-v7rq-q392

Stored XSS in upload files
CVE-2020-26224: Insufficient Information (NVD-CWE-noinfo)
value: In PrestaShop before version 1.7.6.9 an attacker is able to list all the orders placed on the website without being logged by abusing the function that allows a shopping cart to be recreated from an order already placed. The problem is fixed in 1.7.6.9.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 7.5
Published: 2020-11-16T22:15Z
Repository: https://github.com/PrestaShop/PrestaShop
Language: Unknown
Commit date: 2020-11-16 10:47:20 +0100
Commit message: Merge pull request from GHSA-frf2-c9q3-qg9m

Make sure the user is connected before submit reorder
CVE-2020-4074: Improper Authentication (CWE-287)
value: In PrestaShop from version 1.5.0.0 and before version 1.7.6.6, the authentication system is malformed and an attacker is able to forge requests and execute admin commands. The problem is fixed in 1.7.6.6.
CWE description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CVSS v3 base score: 9.8
Published: 2020-07-02T17:15Z
Repository: https://github.com/PrestaShop/PrestaShop
Language: Unknown
Commit date: 2020-06-29 14:20:40 +0200
Commit message: Merge pull request from GHSA-ccvh-jh5x-mpg4

Improper authentication
CVE-2020-5250: Files or Directories Accessible to External Parties (CWE-552)
value: In PrestaShop before version 1.7.6.4, when a customer edits their address, they can freely change the id_address in the form, and thus steal someone else's address. It is the same with CustomerForm, you are able to change the id_customer and change all information of all accounts. The problem is patched in version 1.7.6.4.
CWE description: The product makes files or directories accessible to unauthorized actors, even though they should not be.
CVSS v3 base score: 6.3
Published: 2020-03-05T17:15Z
Repository: https://github.com/PrestaShop/PrestaShop
Language: Unknown
Commit date: 2020-03-02 10:52:39 +0100
Commit message: Merge pull request from GHSA-mhfc-6rhg-fxp3

Fix possible personal data leak
CVE-2020-5264: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: In PrestaShop before version 1.7.6.5, there is a reflected XSS while running the security compromised page. It allows anyone to execute arbitrary action. The problem is patched in the 1.7.6.5.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2020-04-20T17:15Z
Repository: https://github.com/PrestaShop/PrestaShop
Language: Unknown
Commit date: 2020-04-15 11:06:52 +0200
Commit message: Merge pull request from GHSA-48vj-vvr6-jj4f

The url must be tested before used as a button link
CVE-2020-5265: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: In PrestaShop between versions 1.7.6.1 and 1.7.6.5, there is a reflected XSS on AdminAttributesGroups page. The problem is patched in 1.7.6.5.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2020-04-20T17:15Z
Repository: https://github.com/PrestaShop/PrestaShop
Language: Unknown
Commit date: 2020-04-15 11:07:31 +0200
Commit message: Merge pull request from GHSA-7fmr-5vcc-329j

Always cast integer when it's related to ids on AdminAttributesGroupsController
CVE-2020-5269: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: In PrestaShop between versions 1.7.6.1 and 1.7.6.5, there is a reflected XSS on AdminFeatures page by using the `id_feature` parameter. The problem is fixed in 1.7.6.5
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2020-04-20T17:15Z
Repository: https://github.com/PrestaShop/PrestaShop
Language: Unknown
Commit date: 2020-04-15 11:08:32 +0200
Commit message: Merge pull request from GHSA-87jh-7xpg-6v93

Escape the document.location link and always cast ids
CVE-2020-5270: URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)
value: In PrestaShop between versions 1.7.6.0 and 1.7.6.5, there is an open redirection when using back parameter. The impacts can be many, and vary from the theft of information and credentials to the redirection to malicious websites containing attacker-controlled content, which in some cases even cause XSS attacks. So even though an open redirection might sound harmless at first, the impacts of it can be severe should it be exploitable. The problem is fixed in 1.7.6.5
CWE description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
CVSS v3 base score: 6.1
Published: 2020-04-20T17:15Z
Repository: https://github.com/PrestaShop/PrestaShop
Language: Unknown
Commit date: 2020-04-15 11:45:04 +0200
Commit message: Merge pull request from GHSA-375w-q56h-h7qc

Check if the user is connected before using the back parameter
CVE-2020-5271: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: In PrestaShop between versions 1.6.0.0 and 1.7.6.5, there is a reflected XSS with `date_from` and `date_to` parameters in the dashboard page This problem is fixed in 1.7.6.5
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2020-04-20T17:15Z
Repository: https://github.com/PrestaShop/PrestaShop
Language: Unknown
Commit date: 2020-04-15 11:16:10 +0200
Commit message: Merge pull request from GHSA-m2x6-c2c6-pjrx

Make sure date_from and date_to are dates
CVE-2020-5272: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: In PrestaShop between versions 1.5.5.0 and 1.7.6.5, there is a reflected XSS on Search page with `alias` and `search` parameters. The problem is patched in 1.7.6.5
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2020-04-20T17:15Z
Repository: https://github.com/PrestaShop/PrestaShop
Language: Unknown
Commit date: 2020-04-15 11:16:27 +0200
Commit message: Merge pull request from GHSA-rpg3-f23r-jmqv

Escape alias and search for safe output
CVE-2020-5276: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: In PrestaShop between versions 1.7.1.0 and 1.7.6.5, there is a reflected XSS on AdminCarts page with `cartBox` parameter The problem is fixed in 1.7.6.5
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2020-04-20T17:15Z
Repository: https://github.com/PrestaShop/PrestaShop
Language: Unknown
Commit date: 2020-04-15 11:17:45 +0200
Commit message: Merge pull request from GHSA-q6pr-42v5-v97q

Id must be cast in integer
CVE-2020-5278: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: In PrestaShop between versions 1.5.4.0 and 1.7.6.5, there is a reflected XSS on Exception page The problem is fixed in 1.7.6.5
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2020-04-20T17:15Z
Repository: https://github.com/PrestaShop/PrestaShop
Language: Unknown
Commit date: 2020-04-15 11:18:00 +0200
Commit message: Merge pull request from GHSA-mrpj-67mq-3fr5

Escape exception message when rendering PrestaShopException
CVE-2020-5279: Incorrect Authorization (CWE-863)
value: In PrestaShop between versions 1.5.0.0 and 1.7.6.5, there are improper access control since the the version 1.5.0.0 for legacy controllers. - admin-dev/index.php/configure/shop/customer-preferences/ - admin-dev/index.php/improve/international/translations/ - admin-dev/index.php/improve/international/geolocation/ - admin-dev/index.php/improve/international/localization - admin-dev/index.php/configure/advanced/performance - admin-dev/index.php/sell/orders/delivery-slips/ - admin-dev/index.php?controller=AdminStatuses The problem is fixed in 1.7.6.5
CWE description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVSS v3 base score: 6.5
Published: 2020-04-20T17:15Z
Repository: https://github.com/PrestaShop/PrestaShop
Language: Unknown
Commit date: 2020-04-15 15:02:29 +0200
Commit message: Merge pull request from GHSA-74vp-ww64-w2gm

Improper access control for controllers
CVE-2020-5285: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: In PrestaShop between versions 1.7.6.0 and 1.7.6.5, there is a reflected XSS with `back` parameter. The problem is fixed in 1.7.6.5
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2020-04-20T17:15Z
Repository: https://github.com/PrestaShop/PrestaShop
Language: Unknown
Commit date: 2020-04-15 11:19:11 +0200
Commit message: Merge pull request from GHSA-j3r6-33hf-m8wh

Do not use useless is_safe_callback option, auto escape the extension's result
CVE-2020-5286: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: In PrestaShop between versions 1.7.4.0 and 1.7.6.5, there is a reflected XSS when uploading a wrong file. The problem is fixed in 1.7.6.5
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2020-04-20T17:15Z
Repository: https://github.com/PrestaShop/PrestaShop
Language: Unknown
Commit date: 2020-04-15 11:19:37 +0200
Commit message: Merge pull request from GHSA-98j8-hvjv-x47j

Use .text instead of .html to render messages
CVE-2020-5287: Incorrect Authorization (CWE-863)
value: In PrestaShop between versions 1.5.5.0 and 1.7.6.5, there is improper access control on customers search. The problem is fixed in 1.7.6.5.
CWE description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVSS v3 base score: 6.5
Published: 2020-04-20T17:15Z
Repository: https://github.com/PrestaShop/PrestaShop
Language: Unknown
Commit date: 2020-04-15 11:19:56 +0200
Commit message: Merge pull request from GHSA-r6rp-6gv6-r9hq

Do not return sensitives data in the search customers handler
CVE-2020-5288: Incorrect Authorization (CWE-863)
value: "In PrestaShop between versions 1.7.0.0 and 1.7.6.5, there is improper access controls on product attributes page. The problem is fixed in 1.7.6.5.
CWE description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVSS v3 base score: 6.5
Published: 2020-04-20T17:15Z
Repository: https://github.com/PrestaShop/PrestaShop
Language: Unknown
Commit date: 2020-04-15 11:20:20 +0200
Commit message: Merge pull request from GHSA-4wxg-33h3-3w5r

Add @AdminSecurity annotation on AttributeController
CVE-2020-5293: Incorrect Authorization (CWE-863)
value: In PrestaShop between versions 1.7.0.0 and 1.7.6.5, there are improper access controls on product page with combinations, attachments and specific prices. The problem is fixed in 1.7.6.5.
CWE description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVSS v3 base score: 6.5
Published: 2020-04-20T17:15Z
Repository: https://github.com/PrestaShop/PrestaShop
Language: Unknown
Commit date: 2020-04-15 12:01:32 +0200
Commit message: Merge pull request from GHSA-cvjj-grfv-f56w

Add @AdminSecurity annotations
CVE-2021-21302: Improper Neutralization of Formula Elements in a CSV File (CWE-1236)
value: PrestaShop is a fully scalable open source e-commerce solution. In PrestaShop before version 1.7.2 there is a CSV Injection vulnerability possible by using shop search keywords via the admin panel. The problem is fixed in 1.7.7.2
CWE description: The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.
CVSS v3 base score: 7.2
Published: 2021-02-26T20:15Z
Repository: https://github.com/PrestaShop/PrestaShop
Language: Unknown
Commit date: 2021-02-22 10:19:05 +0100
Commit message: Merge pull request from GHSA-2rw4-2p99-cmx9

Escape characters during module csv export
CVE-2021-21308: Improper Authentication (CWE-287)
value: PrestaShop is a fully scalable open source e-commerce solution. In PrestaShop before version 1.7.2 the soft logout system is not complete and an attacker is able to foreign request and executes customer commands. The problem is fixed in 1.7.7.2
CWE description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CVSS v3 base score: 9.1
Published: 2021-02-26T20:15Z
Repository: https://github.com/PrestaShop/PrestaShop
Language: Unknown
Commit date: 2021-02-22 10:20:32 +0100
Commit message: Merge pull request from GHSA-557h-hf3c-whcg

Make sure session is cleared using soft logout
CVE-2021-21398: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: PrestaShop is a fully scalable open source e-commerce solution. In PrestaShop before version 1.7.7.3, an attacker can inject HTML when the Grid Column Type DataColumn is badly used. The problem is fixed in 1.7.7.3
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2021-03-30T16:15Z
Repository: https://github.com/PrestaShop/PrestaShop
Language: Unknown
Commit date: 2021-03-22 16:26:31 +0100
Commit message: Merge pull request from GHSA-fhhq-4x46-qx77
CVE-2022-21686: Improper Control of Generation of Code ('Code Injection') (CWE-94)
value: PrestaShop is an Open Source e-commerce platform. Starting with version 1.7.0.0 and ending with version 1.7.8.3, an attacker is able to inject twig code inside the back office when using the legacy layout. The problem is fixed in version 1.7.8.3. There are no known workarounds.
CWE description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CVSS v3 base score: 9.8
Published: 2022-01-26T20:15Z
Repository: https://github.com/PrestaShop/PrestaShop
Language: Unknown
Commit date: 2022-01-26 10:20:05 +0100
Commit message: Merge pull request from GHSA-mrq4-7ch7-2465

Properly escape smarty output for twig
CVE-2022-31181: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: PrestaShop is an Open Source e-commerce platform. In versions from 1.6.0.10 and before 1.7.8.7 PrestaShop is subject to an SQL injection vulnerability which can be chained to call PHP's Eval function on attacker input. The problem is fixed in version 1.7.8.7. Users are advised to upgrade. Users unable to upgrade may delete the MySQL Smarty cache feature.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2022-08-01T20:15Z
Repository: https://github.com/PrestaShop/PrestaShop
Language: Unknown
Commit date: 2022-07-25 10:51:31 +0200
Commit message: Merge pull request from GHSA-hrgx-p36p-89q4

Crypt/decrypt smarty cache in DB
CVE-2022-46158: Missing Authorization (CWE-862)
value: PrestaShop is an open-source e-commerce solution. Versions prior to 1.7.8.8 did not properly restrict host filesystem access for users. Users may have been able to view the contents of the upload directory without appropriate permissions. This issue has been addressed and users are advised to upgrade to version 1.7.8.8. There are no known workarounds for this issue.
CWE description: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVSS v3 base score: 4.3
Published: 2022-12-08T22:15Z
Repository: https://github.com/PrestaShop/PrestaShop
Language: Unknown
Commit date: 2022-12-06 15:40:19 +0100
Commit message: Merge pull request from GHSA-9qgp-9wwc-v29r

User needs to have rights to see /uploads/* content
CVE-2023-30545: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: PrestaShop is an Open Source e-commerce web application. Prior to versions 8.0.4 and 1.7.8.9, it is possible for a user with access to the SQL Manager (Advanced Options -> Database) to arbitrarily read any file on the operating system when using SQL function `LOAD_FILE` in a `SELECT` request. This gives the user access to critical information. A patch is available in PrestaShop 8.0.4 and PS 1.7.8.9

CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 6.5
Published: 2023-04-25T18:15Z
Repository: https://github.com/PrestaShop/PrestaShop
Language: Unknown
Commit date: 2023-04-25 14:49:23 +0200
Commit message: Merge pull request from GHSA-8r4m-5p6p-52rp

Fix arbitrary file ready through sql manager
CVE-2023-30838: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: PrestaShop is an Open Source e-commerce web application. Prior to versions 8.0.4 and 1.7.8.9, the `ValidateCore::isCleanHTML()` method of Prestashop misses hijackable events which can lead to cross-site scripting (XSS) injection, allowed by the presence of pre-setup `@keyframes` methods. This XSS, which hijacks HTML attributes, can be triggered without any interaction by the visitor/administrator, which makes it as dangerous as a trivial XSS attack. Contrary to other attacks which target HTML attributes and are triggered without user interaction (such as onload / onerror which suffer from a very limited scope), this one can hijack every HTML element, which increases the danger due to a complete HTML elements scope. Versions 8.0.4 and 1.7.8.9 contain a fix for this issue.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 9.9
Published: 2023-04-25T19:15Z
Repository: https://github.com/PrestaShop/PrestaShop
Language: Unknown
Commit date: 2023-04-25 14:48:56 +0200
Commit message: Merge pull request from GHSA-fh7r-996q-gvcp

add missing events in isCleanHtml
CVE-2023-30839: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: PrestaShop is an Open Source e-commerce web application. Versions prior to 8.0.4 and 1.7.8.9 contain a SQL filtering vulnerability. A BO user can write, update, and delete in the database, even without having specific rights. PrestaShop 8.0.4 and 1.7.8.9 contain a patch for this issue. There are no known workarounds.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 8.8
Published: 2023-04-25T19:15Z
Repository: https://github.com/PrestaShop/PrestaShop
Language: Unknown
Commit date: 2023-04-25 14:46:32 +0200
Commit message: Merge pull request from GHSA-p379-cxqh-q822

Fix executeS method making sure it does selection only
CVE-2023-39524: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, SQL injection possible in the product search field, in BO's product page. Version 8.1.1 contains a patch for this issue. There are no known workarounds.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-08-07T20:15Z
Repository: https://github.com/PrestaShop/PrestaShop
Language: Unknown
Commit date: 2023-07-20 10:21:05 +0200
Commit message: Merge remote-tracking branch 'ghsa-75p5-jwx4-qw9h/fix-advisory-1' into release/8.1.1
CVE-2023-39525: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, in the back office, files can be compromised using path traversal by replaying the import file deletion query with a specified file path that uses the traversal path. Version 8.1.1 contains a patch for this issue. There are no known workarounds.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 9.1
Published: 2023-08-07T21:15Z
Repository: https://github.com/PrestaShop/PrestaShop
Language: Unknown
Commit date: 2023-07-20 10:22:24 +0200
Commit message: Merge remote-tracking branch 'ghsa-m9r4-3fg7-pqm2/8.1.x' into release/8.1.1
CVE-2023-39526: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: PrestaShop is an open source e-commerce web application. Versions prior to 1.7.8.10, 8.0.5, and 8.1.1 are vulnerable to remote code execution through SQL injection and arbitrary file write in the back office. Versions 1.7.8.10, 8.0.5, and 8.1.1 contain a patch. There are no known workarounds.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-08-07T21:15Z
Repository: https://github.com/PrestaShop/PrestaShop
Language: Unknown
Commit date: 2023-07-20 10:23:20 +0200
Commit message: Merge remote-tracking branch 'ghsa-gf46-prm4-56pc/fix-advisory-1' into release/8.1.1
CVE-2023-39527: Improper Encoding or Escaping of Output (CWE-116)
value: PrestaShop is an open source e-commerce web application. Versions prior to 1.7.8.10, 8.0.5, and 8.1.1 are vulnerable to cross-site scripting through the `isCleanHTML` method. Versions 1.7.8.10, 8.0.5, and 8.1.1 contain a patch. There are no known workarounds.
CWE description: The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
CVSS v3 base score: 6.1
Published: 2023-08-07T21:15Z
Repository: https://github.com/PrestaShop/PrestaShop
Language: Unknown
Commit date: 2023-07-20 10:23:48 +0200
Commit message: Merge remote-tracking branch 'ghsa-xw2r-f8xv-c8xp/fix-advisory-1' into release/8.1.1
CVE-2023-39527: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: PrestaShop is an open source e-commerce web application. Versions prior to 1.7.8.10, 8.0.5, and 8.1.1 are vulnerable to cross-site scripting through the `isCleanHTML` method. Versions 1.7.8.10, 8.0.5, and 8.1.1 contain a patch. There are no known workarounds.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-08-07T21:15Z
Repository: https://github.com/PrestaShop/PrestaShop
Language: Unknown
Commit date: 2023-07-20 10:23:48 +0200
Commit message: Merge remote-tracking branch 'ghsa-xw2r-f8xv-c8xp/fix-advisory-1' into release/8.1.1