deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-1912
Published: 2024-02-27
Description: The Categorify plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.7.4. This is due to missing or incorrect nonce validation on the categorifyAjaxUpdateFolderPosition function. This makes it possible for unauthenticated attackers to update the folder position of categories as well as update the metadata of other taxonomies via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://plugins.trac.wordpress.org/changeset/3034410/categorify; https://www.wordfence.com/threat-intel/vulnerabilities/id/6ca28c91-f75e-4691-91cf-459cc9da5ad8?source=cve; https://plugins.trac.wordpress.org/changeset/3034410/categorify
CVE: CVE-2024-0197
Published: 2024-02-27
Description: A flaw in the installer for Thales SafeNet Sentinel HASP LDK prior to 9.16 on Windows allows an attacker to escalate their privilege level via local access.


CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://supportportal.thalesgroup.com; https://supportportal.thalesgroup.com
CVE: CVE-2024-1918
Published: 2024-02-27
Description: A vulnerability has been found in Byzoro Smart S42 Management Platform up to 20240219 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /useratte/userattestation.php. The manipulation of the argument hidwel leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-254839. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-434
References: https://github.com/Echosssy/CVE/blob/main/%E5%85%B3%E4%BA%8ESmart%20S42%E7%AE%A1%E7%90%86%E5%B9%B3%E5%8F%B0%E5%AD%98%E5%9C%A8%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E6%BC%8F%E6%B4%9E%E7%9A%84%E6%83%85%E5%86%B5%E9%80%9A%E6%8A%A5-userattestation.php.docx; https://vuldb.com/?ctiid.254839; https://vuldb.com/?id.254839
CVE: CVE-2023-51747
Published: 2024-02-27
Description: Apache James prior to versions 3.8.1 and 3.7.5 is vulnerable to SMTP smuggling.

A lenient behaviour in line delimiter handling might create a difference of interpretation between the sender and the receiver which can be exploited by an attacker to forge an SMTP envelop, allowing for instance to bypass SPF checks.

The patch implies enforcement of CRLF as a line delimiter as part of the DATA transaction.

We recommend James users to upgrade to non vulnerable versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20, CWE-290, CWE-444
References: http://www.openwall.com/lists/oss-security/2024/02/27/4; https://lists.apache.org/thread/rxkwbkh9vgbl9rzx1fkllyk3krhgydko; https://postfix.org/smtp-smuggling.html
CVE: CVE-2024-0551
Published: 2024-02-27
Description: Enable exports of the database and associated exported information of the system via the default user role. The attacked would have to have been granted access to the system prior to the attack.

It is worth noting that the deterministic nature of the export name is lower risk as the UI for exporting would start the download at the same time, which once downloaded - deletes the export from the system.

The endpoint for exporting should simply be patched to a higher privilege level.
CVSS Score: 7.1 (HIGH)
CWE: CWE-284
References: https://github.com/mintplex-labs/anything-llm/commit/7aaa4b38e7112a6cd879c1238310c56b1844c6d8; https://huntr.com/bounties/f114c787-ab5f-4f83-afa5-c000435efb78; https://github.com/mintplex-labs/anything-llm/commit/7aaa4b38e7112a6cd879c1238310c56b1844c6d8
CVE: CVE-2024-0819
Published: 2024-02-27
Description: 
Improper initialization of default settings in TeamViewer Remote Client prior version 15.51.5 for Windows, Linux and macOS, allow a low privileged user to elevate privileges by changing the personal password setting and establishing a remote connection to a logged-in admin account.


CVSS Score: 7.3 (HIGH)
CWE: CWE-269
References: https://www.teamviewer.com/en/trust-center/security-bulletins/tv-2024-1001/; https://www.teamviewer.com/en/trust-center/security-bulletins/tv-2024-1001/
CVE: CVE-2024-1919
Published: 2024-02-27
Description: A vulnerability classified as problematic was found in SourceCodester Online Job Portal 1.0. This vulnerability affects unknown code of the file /Employer/ManageWalkin.php of the component Manage Walkin Page. The manipulation of the argument Job Title leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-254854 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://prnt.sc/1W0g0F8vv2mw; https://vuldb.com/?ctiid.254854; https://vuldb.com/?id.254854
CVE: CVE-2024-1920
Published: 2024-02-27
Description: A vulnerability, which was classified as critical, has been found in osuuu LightPicture up to 1.2.2. This issue affects the function handle of the file /app/middleware/TokenVerify.php. The manipulation leads to use of hard-coded cryptographic key . The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-254855.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-321
References: https://note.zhaoj.in/share/gKyCbSSdJ5fY; https://vuldb.com/?ctiid.254855; https://vuldb.com/?id.254855
CVE: CVE-2023-5947
Published: 2024-02-27
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-7247. Reason: This candidate is a duplicate of CVE-2023-7247. Notes: All CVE users should reference CVE-2023-7247 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2024-1423
Published: 2024-02-27
Description: Rejected reason: Accidental Request
CVE: CVE-2024-1921
Published: 2024-02-27
Description: A vulnerability, which was classified as critical, was found in osuuu LightPicture up to 1.2.2. Affected is an unknown function of the file /app/controller/Setup.php. The manipulation leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-254856.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-434
References: https://note.zhaoj.in/share/FeCRflSHPLbj; https://vuldb.com/?ctiid.254856; https://vuldb.com/?id.254856
CVE: CVE-2024-25723
Published: 2024-02-27
Description: ZenML Server in the ZenML machine learning package before 0.46.7 for Python allows remote privilege escalation because the /api/v1/users/{user_name_or_id}/activate REST API endpoint allows access on the basis of a valid username along with a new password in the request body. These are also patched versions: 0.44.4, 0.43.1, and 0.42.2.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: https://github.com/zenml-io/zenml; https://github.com/zenml-io/zenml/compare/0.42.1...0.42.2; https://github.com/zenml-io/zenml/compare/0.43.0...0.43.1
CVE: CVE-2024-27507
Published: 2024-02-27
Description: libLAS 1.8.1 contains a memory leak vulnerability in /libLAS/apps/ts2las.cpp.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401
References: https://github.com/LuMingYinDetect/libLAS_defects/blob/main/libLAS_detect_1.md; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3QRV2D4GYUZNZRJHVGFSYSOSZLCETI4E/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2B6GZQ3WUVFNAAWFQJAQY7UM4OH5TA/
CVE: CVE-2024-27905
Published: 2024-02-27
Description: ** UNSUPPORTED WHEN ASSIGNED ** Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Aurora.

An endpoint exposing internals to unauthenticated users can be used as a "padding oracle" allowing an anonymous attacker to construct a valid authentication cookie. Potentially this could be combined with vulnerabilities in other components to achieve remote code execution.

As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.

NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2024/02/27/3; https://lists.apache.org/thread/564kbv3wqdzkscmdn2bg4vlk48qymryp; http://www.openwall.com/lists/oss-security/2024/02/27/3
CVE: CVE-2024-1403
Published: 2024-02-27
Description: In OpenEdge Authentication Gateway and AdminServer prior to 11.7.19, 12.2.14, 12.8.1 on all platforms supported by the OpenEdge product, an authentication bypass vulnerability has been identified.  The
vulnerability is a bypass to authentication based on a failure to properly
handle username and password.  Certain unexpected
content passed into the credentials can lead to unauthorized access without proper
authentication.    







CVSS Score: 10.0 (CRITICAL)
CWE: CWE-305
References: https://community.progress.com/s/article/Important-Critical-Alert-for-OpenEdge-Authentication-Gateway-and-AdminServer; https://www.progress.com/openedge; https://community.progress.com/s/article/Important-Critical-Alert-for-OpenEdge-Authentication-Gateway-and-AdminServer
CVE: CVE-2024-1922
Published: 2024-02-27
Description: A vulnerability has been found in SourceCodester Online Job Portal 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /Employer/ManageJob.php of the component Manage Job Page. The manipulation of the argument Qualification/Description leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-254857 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://prnt.sc/WD3nof5FsEBv; https://prnt.sc/zw3SnPnfpKGu; https://vuldb.com/?ctiid.254857
CVE: CVE-2024-1923
Published: 2024-02-27
Description: A vulnerability was found in SourceCodester Simple Student Attendance System 1.0 and classified as critical. Affected by this issue is the function delete_class/delete_student of the file /ajax-api.php of the component List of Classes Page. The manipulation of the argument id with the input 1337'+or+1=1;--+ leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-254858 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/smurf-reigz/security/blob/main/proof-of-concepts/SOURCECODESTER%20%5BSimple%20Student%20Attendance%20System%20using%20PHP%20and%20MySQL%5D%20SQLi%20on%20ajax-api.php%3Faction=delete_class.md; https://vuldb.com/?ctiid.254858; https://vuldb.com/?id.254858
CVE: CVE-2024-25398
Published: 2024-02-27
Description: In Srelay (the SOCKS proxy and Relay) v.0.4.8p3, a specially crafted network payload can trigger a denial of service condition and disrupt the service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/Nivedita-22/SRELAY-exploit-writeup/blob/main/Srelay.md; https://sourceforge.net/projects/socks-relay/; https://github.com/Nivedita-22/SRELAY-exploit-writeup/blob/main/Srelay.md
CVE: CVE-2024-25399
Published: 2024-02-27
Description: Subrion CMS 4.2.1 is vulnerable to Cross Site Scripting (XSS) via adminer.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://cwe.mitre.org/data/definitions/79; https://cwe.mitre.org/data/definitions/79
CVE: CVE-2024-25400
Published: 2024-02-27
Description: Subrion CMS 4.2.1 is vulnerable to SQL Injection via ia.core.mysqli.php. NOTE: this is disputed by multiple third parties because it refers to an HTTP request to a PHP file that only contains a class, without any mechanism for accepting external input, and the reportedly vulnerable method is not present in the file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/intelliants/subrion/issues/910; https://github.com/intelliants/subrion/issues/910; https://github.com/intelliants/subrion/issues/910
CVE: CVE-2024-26142
Published: 2024-02-27
Description: Rails is a web-application framework. Starting in version 7.1.0, there is a possible ReDoS vulnerability in the Accept header parsing routines of Action Dispatch. This vulnerability is patched in 7.1.3.1. Ruby 3.2 has mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1333, CWE-1333
References: https://discuss.rubyonrails.org/t/possible-redos-vulnerability-in-accept-header-parsing-in-action-dispatch/84946; https://github.com/rails/rails/commit/b4d3bfb5ed8a5b5a90aad3a3b28860c7a931e272; https://github.com/rails/rails/security/advisories/GHSA-jjhx-jhvp-74wq
CVE: CVE-2024-26143
Published: 2024-02-27
Description: Rails is a web-application framework. There is a possible XSS vulnerability when using the translation helpers in Action Controller. Applications using translation methods like translate, or t on a controller, with a key ending in "_html", a :default key which contains untrusted user input, and the resulting string is used in a view, may be susceptible to an XSS vulnerability. The vulnerability is fixed in 7.1.3.1 and 7.0.8.1.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://discuss.rubyonrails.org/t/possible-xss-vulnerability-in-action-controller/84947; https://github.com/rails/rails/commit/4c83b331092a79d58e4adffe4be5f250fa5782cc; https://github.com/rails/rails/commit/5187a9ef51980ad1b8e81945ebe0462d28f84f9e
CVE: CVE-2024-26144
Published: 2024-02-27
Description: Rails is a web-application framework. Starting with version 5.2.0, there is a possible sensitive session information leak in Active Storage. By default, Active Storage sends a Set-Cookie header along with the user's session cookie when serving blobs. It also sets Cache-Control to public. Certain proxies may cache the Set-Cookie, leading to an information leak. The vulnerability is fixed in 7.0.8.1 and 6.1.7.7.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://discuss.rubyonrails.org/t/possible-sensitive-session-information-leak-in-active-storage/84945; https://github.com/rails/rails/commit/723f54566023e91060a67b03353e7c03e7436433; https://github.com/rails/rails/commit/78fe149509fac5b05e54187aaaef216fbb5fd0d3
CVE: CVE-2024-26464
Published: 2024-02-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2024-27508
Published: 2024-02-27
Description: Atheme 7.2.12 contains a memory leak vulnerability in /atheme/src/crypto-benchmark/main.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401
References: https://github.com/LuMingYinDetect/Atheme_defects/blob/main/Atheme_detect_1.md; https://github.com/LuMingYinDetect/Atheme_defects/blob/main/Atheme_detect_1.md
CVE: CVE-2023-48678
Published: 2024-02-27
Description: Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 37391.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-276
References: https://security-advisory.acronis.com/advisories/SEC-2319; https://security-advisory.acronis.com/advisories/SEC-2319
CVE: CVE-2023-48679
Published: 2024-02-27
Description: Stored cross-site scripting (XSS) vulnerability due to missing origin validation in postMessage. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 37391.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://security-advisory.acronis.com/advisories/SEC-3469; https://security-advisory.acronis.com/advisories/SEC-3469
CVE: CVE-2023-48680
Published: 2024-02-27
Description: Sensitive information disclosure due to excessive collection of system information. The following products are affected: Acronis Cyber Protect 16 (macOS, Windows) before build 37391.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-359
References: https://security-advisory.acronis.com/advisories/SEC-5392; https://security-advisory.acronis.com/advisories/SEC-5392
CVE: CVE-2023-48681
Published: 2024-02-27
Description: Self cross-site scripting (XSS) vulnerability in storage nodes search field. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 37391.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://security-advisory.acronis.com/advisories/SEC-5900; https://security-advisory.acronis.com/advisories/SEC-5900
CVE: CVE-2023-48682
Published: 2024-02-27
Description: Stored cross-site scripting (XSS) vulnerability in unit name. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 37391.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://security-advisory.acronis.com/advisories/SEC-5901; https://security-advisory.acronis.com/advisories/SEC-5901
CVE: CVE-2023-50380
Published: 2024-02-27
Description: XML External Entity injection in apache ambari versions <= 2.7.7, Users are recommended to upgrade to version 2.7.8, which fixes this issue.

More Details:

Oozie Workflow Scheduler had a vulnerability that allowed for root-level file reading and privilege escalation from low-privilege users. The vulnerability was caused through lack of proper user input validation.

This vulnerability is known as an XML External Entity (XXE) injection attack. Attackers can exploit XXE vulnerabilities to read arbitrary files on the server, including sensitive system files. In theory, it might be possible to use this to escalate privileges.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-611
References: http://www.openwall.com/lists/oss-security/2024/02/27/6; https://lists.apache.org/thread/qrt7mq7v7zyrh1qsh1gkg1m7clysvy32; http://www.openwall.com/lists/oss-security/2024/02/27/6
CVE: CVE-2024-1924
Published: 2024-02-27
Description: A vulnerability was found in CodeAstro Membership Management System 1.0. It has been classified as critical. This affects an unknown part of the file /get_membership_amount.php. The manipulation of the argument membershipTypeId leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-254859.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/1testnew/CVE_Hunter/blob/main/SQLi-1.md; https://vuldb.com/?ctiid.254859; https://vuldb.com/?id.254859
CVE: CVE-2024-1925
Published: 2024-02-27
Description: A vulnerability was found in Ctcms 2.1.2. It has been declared as critical. This vulnerability affects unknown code of the file ctcms/apps/controllers/admin/Upsys.php. The manipulation leads to unrestricted upload. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-254860.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-434
References: https://docs.qq.com/doc/DQkVmRXBlbGNPZmlL; https://vuldb.com/?ctiid.254860; https://vuldb.com/?id.254860
CVE: CVE-2024-1926
Published: 2024-02-27
Description: A vulnerability was found in SourceCodester Free and Open Source Inventory Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /app/ajax/search_sales_report.php. The manipulation of the argument customer leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-254861 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/xiahao90/CVEproject/blob/main/xiahao.webray.com.cn/Free%20and%20Open%20Source%20inventory%20management%20system-SQLi.md; https://vuldb.com/?ctiid.254861; https://vuldb.com/?id.254861
CVE: CVE-2024-21742
Published: 2024-02-27
Description: Improper input validation allows for header injection in MIME4J library when using MIME4J DOM for composing message.
This can be exploited by an attacker to add unintended headers to MIME messages.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-74, CWE-74
References: https://lists.apache.org/thread/nrqzg93219wdj056pqfszsd33dc54kfy; http://www.openwall.com/lists/oss-security/2024/02/27/5; https://lists.apache.org/thread/nrqzg93219wdj056pqfszsd33dc54kfy
CVE: CVE-2024-24323
Published: 2024-02-27
Description: SQL injection vulnerability in linlinjava litemall v.1.8.0 allows a remote attacker to obtain sensitive information via the nickname, consignee, orderSN, orderStatusArray parameters of the AdminOrdercontroller.java component.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/lousix/exp/blob/main/CVE-2024-24323/CVE-2024-24323.md; https://github.com/lousix/exp/blob/main/CVE-2024-24323/CVE-2024-24323.md
CVE: CVE-2024-25840
Published: 2024-02-27
Description: In the module "Account Manager | Sales Representative & Dealers | CRM" (prestasalesmanager) up to 9.0 from Presta World for PrestaShop, a guest can download personal information without restriction by performing a path traversal attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-31
References: https://addons.prestashop.com/en/third-party-data-integrations-crm-erp/90816-account-manager-sales-representative-dealers-crm.html; https://security.friendsofpresta.org/modules/2024/02/27/prestasalesmanager.html; https://addons.prestashop.com/en/third-party-data-integrations-crm-erp/90816-account-manager-sales-representative-dealers-crm.html
CVE: CVE-2024-25841
Published: 2024-02-27
Description: In the module "So Flexibilite" (soflexibilite) from Common-Services for PrestaShop < 4.1.26, a guest (authenticated customer) can perform Cross Site Scripting (XSS) injection.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://addons.prestashop.com/fr/transporteurs/2704-colissimo-domicile-et-points-de-retrait.html; https://security.friendsofpresta.org/modules/2024/02/27/soflexibilite.html; https://addons.prestashop.com/fr/transporteurs/2704-colissimo-domicile-et-points-de-retrait.html
CVE: CVE-2024-25843
Published: 2024-02-27
Description: In the module "Import/Update Bulk Product from any Csv/Excel File Pro" (ba_importer) up to version 1.1.28 from Buy Addons for PrestaShop, a guest can perform SQL injection in affected versions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://addons.prestashop.com/en/data-import-export/20579-import-update-bulk-product-from-any-csv-excel-file-pro.html; https://security.friendsofpresta.org/modules/2024/02/27/ba_importer.html; https://addons.prestashop.com/en/data-import-export/20579-import-update-bulk-product-from-any-csv-excel-file-pro.html
CVE: CVE-2024-25846
Published: 2024-02-27
Description: In the module "Product Catalog (CSV, Excel) Import" (simpleimportproduct) <= 6.7.0 from MyPrestaModules for PrestaShop, a guest can upload files with extensions .php.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-434
References: https://addons.prestashop.com/fr/import-export-de-donnees/19091-catalogue-de-produits-csv-excel-dimportation.html; https://security.friendsofpresta.org/modules/2024/02/27/simpleimportproduct.html; https://addons.prestashop.com/fr/import-export-de-donnees/19091-catalogue-de-produits-csv-excel-dimportation.html