Incorrect access control in PrestaShop

A PHAR deserialization vulnerability in the _getHeaders function of PrestaShop v8.2.0 allows attackers to execute arbitrary code via a crafted POST request

A PHAR deserialization vulnerability in the component /themes/import of PrestaShop v8.2.0 allows attackers to execute arbitrary code via a crafted POST request

PrestaShop is an Open Source e-commerce web application

In PrestaShop between versions 1.7.0.0 and 1.7.6.5, there are improper access controls on product page with combinations, attachments and specific prices

"In PrestaShop between versions 1.7.0.0 and 1.7.6.5, there is improper access controls on product attributes page

In PrestaShop between versions 1.5.5.0 and 1.7.6.5, there is improper access control on customers search

In PrestaShop between versions 1.5.0.0 and 1.7.6.5, there are improper access control since the the version 1.5.0.0 for legacy controllers

In PrestaShop before version 1.7.6.4, when a customer edits their address, they can freely change the id_address in the form, and thus steal someone else's address

PrestaShop is an open source e-commerce web application

PrestaShop is an open-source e-commerce platform

PrestaShop is an open-source e-commerce platform

PrestaShop is an open source e-commerce web application

PrestaShop before 1.5.2 allows XSS via the "<object data='data:text/html" substring in the message field

In PrestaShop from version 1.6.0.4 and before version 1.7.6.8 an attacker is able to inject javascript while using the contact form

In PrestaShop from version 1.7.0.0 and before version 1.7.6.6, if a target sends a corrupted file, it leads to a reflected XSS

In PrestaShop between versions 1.7.4.0 and 1.7.6.5, there is a reflected XSS when uploading a wrong file

In PrestaShop between versions 1.7.6.0 and 1.7.6.5, there is a reflected XSS with `back` parameter

In PrestaShop between versions 1.5.4.0 and 1.7.6.5, there is a reflected XSS on Exception page The problem is fixed in 1.7.6.5

In PrestaShop between versions 1.7.1.0 and 1.7.6.5, there is a reflected XSS on AdminCarts page with `cartBox` parameter The problem is fixed in 1.7.6.5

In PrestaShop between versions 1.5.5.0 and 1.7.6.5, there is a reflected XSS on Search page with `alias` and `search` parameters

In PrestaShop between versions 1.6.0.0 and 1.7.6.5, there is a reflected XSS with `date_from` and `date_to` parameters in the dashboard page This problem is fixed in 1.7.6.5

In PrestaShop between versions 1.7.6.0 and 1.7.6.5, there is an open redirection when using back parameter

In PrestaShop between versions 1.7.6.1 and 1.7.6.5, there is a reflected XSS on AdminFeatures page by using the `id_feature` parameter

In PrestaShop between versions 1.7.6.1 and 1.7.6.5, there is a reflected XSS on AdminAttributesGroups page

In PrestaShop before version 1.7.6.5, there is a reflected XSS while running the security compromised page

Cross-site scripting (XSS) vulnerability in PrestaShop before 1.4.9 allows remote attackers to inject arbitrary web script or HTML via the index of the product[] parameter to…

In PrestaShop 1.7.6.2, XSS can occur during addition or removal of a QuickAccess link

In PrestaShop 1.7.5.2, the shop_country parameter in the install/index.php installation script/component is affected by Reflected XSS

PrestaShop before 1.4.11 allows logout CSRF

PrestaShop has multiple stored XSS vulnerabilities via unprotected Template variables

PrestaShop is a fully scalable open source e-commerce solution

In PrestaShop from version 1.5.0.0 and before version 1.7.6.8, users are allowed to send compromised files

In PrestaShop from version 1.5.0.0 and before version 1.7.6.6, there is improper access control in Carrier page, Module Manager and Module Positions

In PrestaShop from version 1.5.3.0 and before version 1.7.6.6, there is a stored XSS when using the name of a quick access item

PrestaShop before 1.4.11 allows Logistician, translators and other low level profiles/accounts to inject a persistent XSS vector on TinyMCE

PrestaShop 1.7.2.4 has XSS via source-code editing on the "Pages > Edit page" screen

PrestaShop: Improper Use of Validation Framework

PrestaShop has a time based enumeration in FO login form

In prestashop 8.1.4, a NULL pointer dereference was identified in the math_round function within Tools.php

PrestaShop is an open source e-commerce web application

PrestaShop is an open-source e-commerce platform

In PrestaShop from version 1.5.0.0 and before 1.7.6.6, there is information exposure in the upload directory

In PrestaShop from version 1.7.4.0 and before version 1.7.6.6, some files should not be in the release archive, and others should not be accessible

PrestaShop 1.7.2.4 allows user enumeration via the Reset Password feature, by noticing which reset attempts do not produce a "This account does not exist" error message

File upload vulnerability in the Catalog feature in Prestashop 1.7.6.7 allows remote attackers to run arbitrary code via the add new file page

PrestaShop is an Open Source e-commerce web application

PrestaShop is an Open Source e-commerce web application

PrestaShop is an open-source e-commerce solution