rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-34821 WordPress Contact List plugin <= 2.9.87 - Broken Access Control vulnerability
Missing Authorization vulnerability in Anssi Laitila Contact List contact-list.This issue affects Contact List: from n/a through <= 2.9.87.
Problem types: cwe_id: CWE-862
description: Missing Authorization
Affected products: vendor: Anssi Laitila
product: Contact List
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Dhabaleshwar Das | Patchstack Bug Bounty Program
Published: 2024-06-11T16:03:58.318Z
CVE-2024-34822 WordPress weMail plugin <= 1.14.2 - Broken Access Control vulnerability
Missing Authorization vulnerability in weDevs weMail.This issue affects weMail: from n/a through 1.14.2.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: weDevs
product: weMail
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Dhabaleshwar Das (Patchstack Alliance)
Published: 2024-06-11T15:26:25.301Z
CVE-2024-34823 WordPress Arigato Autoresponder and Newsletter plugin <= 2.7.2.3 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Kiboko Labs Arigato Autoresponder and Newsletter.This issue affects Arigato Autoresponder and Newsletter: from n/a through 2.7.2.3.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Kiboko Labs
product: Arigato Autoresponder and Newsletter
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Dhabaleshwar Das (Patchstack Alliance)
Published: 2024-05-10T08:21:52.174Z
CVE-2024-34824 WordPress SportsPress – Sports Club & League Manager plugin <= 2.7.20 - Broken Access Control vulnerability
Missing Authorization vulnerability in ThemeBoy SportsPress – Sports Club & League Manager.This issue affects SportsPress – Sports Club & League Manager: from n/a through 2.7.20.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: ThemeBoy
product: SportsPress – Sports Club & League Manager
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Dhabaleshwar Das (Patchstack Alliance)
Published: 2024-06-11T09:27:52.091Z
CVE-2024-34825 WordPress Social Warfare plugin <= 4.4.5.1 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Warfare Plugins Social Warfare.This issue affects Social Warfare: from n/a through 4.4.5.1.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Warfare Plugins
product: Social Warfare
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Majed Refaea (Patchstack Alliance)
Published: 2024-05-10T08:20:02.830Z
CVE-2024-34826 WordPress CF7 WOW Styler plugin <= 1.6.4 - Broken Access Control vulnerability
Missing Authorization vulnerability in Saleswonder Team: Tobias CF7 WOW Styler cf7-styler.This issue affects CF7 WOW Styler: from n/a through <= 1.6.4.
Problem types: cwe_id: CWE-862
description: Missing Authorization
Affected products: vendor: Saleswonder Team: Tobias
product: CF7 WOW Styler
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Dhabaleshwar Das | Patchstack Bug Bounty Program
Published: 2024-06-11T15:07:10.516Z
CVE-2024-34827 WordPress Translate Multilingual sites – TranslatePress plugin <= 2.7.5 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Cozmoslabs, Razvan Mocanu, Madalin Ungureanu, Cristophor Hurduban TranslatePress.This issue affects TranslatePress: from n/a through 2.7.5.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Cozmoslabs, Razvan Mocanu, Madalin Ungureanu, Cristophor Hurduban
product: TranslatePress
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Dhabaleshwar Das (Patchstack Alliance)
Published: 2024-05-10T08:18:05.154Z
CVE-2024-34828 WordPress Church Admin plugin <= 4.1.32 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.1.32.
Problem types: cwe_id: CWE-352
description: Cross-Site Request Forgery (CSRF)
Affected products: vendor: andy_moyle
product: Church Admin
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Dhabaleshwar Das | Patchstack Bug Bounty Program
Published: 2024-05-10T08:16:22.154Z
CVE-2024-34831 
cross-site scripting (XSS) vulnerability in Gibbon Core v26.0.00 allows an attacker to execute arbitrary code via the imageLink parameter in the library_manage_catalog_editProcess.php component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-10T00:00:00.000Z
CVE-2024-34832 
Directory Traversal vulnerability in CubeCart v.6.5.5 and before allows an attacker to execute arbitrary code via a crafted file uploaded to the _g and node parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-06T14:45:49.273Z
CVE-2024-34833 
Sourcecodester Payroll Management System v1.0 is vulnerable to File Upload. Users can upload images via the "save_settings" page. An unauthenticated attacker can leverage this functionality to upload a malicious PHP file instead. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as the user running the web server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-17T00:00:00.000Z
CVE-2024-34852 
F-logic DataCube3 v1.0 is affected by command injection due to improper string filtering at the command execution point in the ./admin/transceiver_schedule.php file. An unauthenticated remote attacker can exploit this vulnerability by sending a file name containing command injection. Successful exploitation of this vulnerability may allow the attacker to execute system commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-28T16:29:35.891Z
CVE-2024-34854 
F-logic DataCube3 v1.0 is vulnerable to File Upload via `/admin/transceiver_schedule.php.`
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-28T16:30:49.517Z
CVE-2024-34882 
Insufficiently protected credentials in SMTP server settings in 1C-Bitrix Bitrix24 23.300.100 allows remote administrators to send SMTP account passwords to an arbitrary server via HTTP POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-04T00:00:00.000Z
CVE-2024-34883 
Insufficiently protected credentials in DAV server settings in 1C-Bitrix Bitrix24 23.300.100 allow remote administrators to read proxy-server accounts passwords via HTTP GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-04T00:00:00.000Z
CVE-2024-34885 
Insufficiently protected credentials in SMTP server settings in 1C-Bitrix Bitrix24 23.300.100 allows remote administrators to read SMTP accounts passwords via HTTP GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-04T00:00:00.000Z
CVE-2024-34887 
Insufficiently protected credentials in AD/LDAP server settings in 1C-Bitrix Bitrix24 23.300.100 allows remote administrators to send AD/LDAP administrators account passwords to an arbitrary server via HTTP POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-04T00:00:00.000Z
CVE-2024-34891 
Insufficiently protected credentials in DAV server settings in 1C-Bitrix Bitrix24 23.300.100 allows remote administrators to read Exchange account passwords via HTTP GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-04T00:00:00.000Z
CVE-2024-34896 
An issue in Nedis SmartLife Video Doorbell (WIFICDP10GY), Nedis SmartLife IOS v1.4.0 causes users who are disconnected from a previous peer-to-peer connection with the device to still have access to live video feed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-03T00:00:00.000Z
CVE-2024-34897 
Nedis SmartLife android app v1.4.0 was discovered to contain an API key disclosure vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-03T00:00:00.000Z
CVE-2024-34899 
WWBN AVideo 12.4 is vulnerable to Cross Site Scripting (XSS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-13T18:40:25.814Z
CVE-2024-34905 
FlyFish v3.0.0 was discovered to contain a buffer overflow via the password parameter on the login page. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-16T14:09:58.576Z
CVE-2024-34906 
An arbitrary file upload vulnerability in dootask v0.30.13 allows attackers to execute arbitrary code via uploading a crafted PDF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-15T19:26:32.658Z
CVE-2024-34909 
An arbitrary file upload vulnerability in KYKMS v1.0.1 and below allows attackers to execute arbitrary code via uploading a crafted PDF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-15T19:26:33.785Z
CVE-2024-34913 
An arbitrary file upload vulnerability in r-pan-scaffolding v5.0 and below allows attackers to execute arbitrary code via uploading a crafted PDF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-15T19:26:34.613Z
CVE-2024-34914 
php-censor v2.1.4 and fixed in v.2.1.5 was discovered to utilize a weak hashing algorithm for its remember_key value. This allows attackers to bruteforce to bruteforce the remember_key value to gain access to accounts that have checked "remember me" when logging in.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-14T15:14:15.606Z
CVE-2024-34919 
An arbitrary file upload vulnerability in the component \modstudent\controller.php of Pisay Online E-Learning System using PHP/MySQL v1.0 allows attackers to execute arbitrary code via uploading a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-17T13:43:54.849Z
CVE-2024-34921 
TOTOLINK X5000R v9.1.0cu.2350_B20230313 was discovered to contain a command injection via the disconnectVPN function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-13T19:23:40.944Z
CVE-2024-34923 
In Avocent DSR2030 Appliance firmware 03.04.00.07 before 03.07.01.23, and SVIP1020 Appliance firmware 01.06.00.03 before 01.07.00.00, there is reflected cross-site scripting (XSS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-27T19:49:56.463Z
CVE-2024-34927 
A SQL injection vulnerability in /model/update_classroom.php in Campcodes Complete Web-Based School Management System 1.0 allows an attacker to execute arbitrary SQL commands via the name parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-23T16:22:36.239Z
CVE-2024-34928 
A SQL injection vulnerability in /model/update_subject_routing.php in Campcodes Complete Web-Based School Management System 1.0 allows an attacker to execute arbitrary SQL commands via the grade parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-23T16:23:34.729Z
CVE-2024-34929 
A SQL injection vulnerability in /view/find_friends.php in Campcodes Complete Web-Based School Management System 1.0 allows an attacker to execute arbitrary SQL commands via the my_index parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-23T16:25:18.387Z
CVE-2024-34930 
A SQL injection vulnerability in /model/all_events1.php in Campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary SQL commands via the month parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-23T16:26:04.192Z
CVE-2024-34931 
A SQL injection vulnerability in /model/update_subject.php in Campcodes Complete Web-Based School Management System 1.0 allows an attacker to execute arbitrary SQL commands via the name parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-23T16:31:56.924Z
CVE-2024-34932 
A SQL injection vulnerability in /model/update_exam.php in Campcodes Complete Web-Based School Management System 1.0 allows an attacker to execute arbitrary SQL commands via the name parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-23T16:33:14.447Z
CVE-2024-34933 
A SQL injection vulnerability in /model/update_grade.php in Campcodes Complete Web-Based School Management System 1.0 allows an attacker to execute arbitrary SQL commands via the admission_fee parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-23T16:33:35.078Z
CVE-2024-34934 
A SQL injection vulnerability in /view/emarks_range_grade_update_form.php in Campcodes Complete Web-Based School Management System 1.0 allows an attacker to execute arbitrary SQL commands via the conversation_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-23T16:33:58.084Z
CVE-2024-34935 
A SQL injection vulnerability in /view/conversation_history_admin.php in Campcodes Complete Web-Based School Management System 1.0 allows an attacker to execute arbitrary SQL commands via the conversation_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-23T16:34:28.795Z
CVE-2024-34936 
A SQL injection vulnerability in /view/event1.php in Campcodes Complete Web-Based School Management System 1.0 allows an attacker to execute arbitrary SQL commands via the month parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-23T16:34:47.750Z
CVE-2024-34942 
Tenda FH1206 V1.2.0.8(8155)_EN was discovered to contain a stack-based buffer overflow vulnerability via the funcpara1 parameter at ip/goform/exeCommand.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-10T12:52:26.230Z
CVE-2024-34943 
Tenda FH1206 V1.2.0.8(8155)_EN was discovered to contain a stack-based buffer overflow vulnerability via the page parameter at ip/goform/NatStaticSetting.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-10T12:51:20.301Z
CVE-2024-34944 
Tenda FH1206 V1.2.0.8(8155)_EN was discovered to contain a stack-based buffer overflow vulnerability via the list1 parameter at ip/goform/DhcpListClient.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-10T12:49:00.996Z
CVE-2024-34945 
Tenda FH1206 V1.2.0.8(8155)_EN was discovered to contain a stack-based buffer overflow vulnerability via the PPW parameter at ip/goform/WizardHandle.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-10T12:50:15.763Z
CVE-2024-34946 
Tenda FH1206 V1.2.0.8(8155)_EN was discovered to contain a stack-based buffer overflow vulnerability via the page parameter at ip/goform/DhcpListClient.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-10T12:44:23.683Z
CVE-2024-34947 
Quanxun Huiju Network Technology (Beijing) Co.,Ltd IK-Q3000 3.7.10 x64 Build202401261655 was discovered to be vulnerable to an ICMP redirect attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-20T16:16:29.639Z
CVE-2024-34948 
An issue in Quanxun Huiju Network Technology(Beijing) Co.,Ltd IK-Q3000 3.7.10 x64 Build202401261655 allows attackers to cause a Denial of Service (DoS) when attempting to make TCP connections.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-20T16:20:56.318Z
CVE-2024-34949 
SQL injection vulnerability in Likeshop before 2.5.7 allows attackers to run abitrary SQL commands via the function OrderLogic::getOrderList function, exploited at the /admin/order/lists.html endpoint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-20T17:47:50.073Z
CVE-2024-34950 
D-Link DIR-822+ v1.0.5 was discovered to contain a stack-based buffer overflow vulnerability in the SetNetworkTomographySettings module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-14T15:27:35.329Z
CVE-2024-34952 
taurusxin ncmdump v1.3.2 was discovered to contain a segmentation violation via the NeteaseCrypt::FixMetadata() function at /src/ncmcrypt.cpp. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted .ncm file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-20T13:09:50.516Z
CVE-2024-34953 
An issue in taurusxin ncmdump v1.3.2 allows attackers to cause a Denial of Service (DoS) via memory exhaustion by supplying a crafted .ncm file
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-20T13:09:51.951Z
CVE-2024-34954 
Code-projects Budget Management 1.0 is vulnerable to Cross Site Scripting (XSS) via the budget parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-15T14:11:55.201Z
CVE-2024-34955 
Code-projects Budget Management 1.0 is vulnerable to SQL Injection via the delete parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-15T14:13:28.781Z
CVE-2024-34957 
idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component admin/sysImages_deal.php?mudi=infoSet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-16T14:34:21.007Z
CVE-2024-34958 
idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component admin/banner_deal.php?mudi=add
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-16T14:32:49.596Z
CVE-2024-34959 
DedeCMS V5.7.113 is vulnerable to Cross Site Scripting (XSS) via sys_data_replace.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-17T19:44:16.166Z
CVE-2024-34974 
Tenda AC18 v15.03.05.19 is vulnerable to Buffer Overflow in the formSetPPTPServer function via the endIp parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-10T12:29:34.817Z
CVE-2024-34982 
An arbitrary file upload vulnerability in the component /include/file.php of lylme_spage v1.9.5 allows attackers to execute arbitrary code via uploading a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-17T13:41:37.200Z
CVE-2024-34987 
A SQL Injection vulnerability exists in the `ofrs/admin/index.php` script of PHPGurukul Online Fire Reporting System 1.2. The vulnerability allows attackers to bypass authentication and gain unauthorized access by injecting SQL commands into the username input field during the login process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-03T00:00:00.000Z
CVE-2024-34988 
SQL injection vulnerability in the module "Complete for Create a Quote in Frontend + Backend Pro" (askforaquotemodul) <= 1.0.51 from Buy Addons for PrestaShop allows attackers to view sensitive information and cause other impacts via methods `AskforaquotemodulcustomernewquoteModuleFrontController::run()`, `AskforaquotemoduladdproductnewquoteModuleFrontController::run()`, `AskforaquotemodulCouponcodeModuleFrontController::run()`, `AskforaquotemodulgetshippingcostModuleFrontController::run()`, `AskforaquotemodulgetstateModuleFrontController::run().`
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-24T00:00:00.000Z
CVE-2024-34989 
In the module RSI PDF/HTML catalog evolution (prestapdf) <= 7.0.0 from RSI for PrestaShop, a guest can perform SQL injection via `PrestaPDFProductListModuleFrontController::queryDb().'
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-21T00:00:00.000Z
CVE-2024-34990 
In the module "Help Desk - Customer Support Management System" (helpdesk) up to version 2.4.0 from FME Modules for PrestaShop, a customer can upload .php files. Methods `HelpdeskHelpdeskModuleFrontController::submitTicket()` and `HelpdeskHelpdeskModuleFrontController::replyTicket()` allow upload of .php files on a predictable path for connected customers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-19T00:00:00.000Z
CVE-2024-34991 
In the module "Axepta" (axepta) before 1.3.4 from Quadra Informatique for PrestaShop, a guest can download partial credit card information (expiry date) / postal address / email / etc. without restriction due to a lack of permissions control.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-24T00:00:00.000Z
CVE-2024-34992 
SQL Injection vulnerability in the module "Help Desk - Customer Support Management System" (helpdesk) up to version 2.4.0 from FME Modules for PrestaShop allows attackers to obtain sensitive information and cause other impacts via 'Tickets::getsearchedtickets()'
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-24T00:00:00.000Z