Myprestamodules vulnerabilities
We track 10 vulnerabilities in Myprestamodules products across 8 products. 10 are rated high or critical, and none are known to be exploited. The most recent was published on March 3, 2024.
Latest Myprestamodules vulnerabilities
- 9.8 Critical severity
product_catalog_import_for_prestashop: Improper Privilege Management
SQL Injection vulnerability in MyPrestaModules "Product Catalog (CSV, Excel) Import" (simpleimportproduct) modules for PrestaShop versions 6.5.0 and before, allows attackers to escalate privileges and obtain sensitive information via Send::__construct() and im
- 9.1 Critical severity
simpleimportproduct: Unrestricted Upload of File with Dangerous Type
In the module "Product Catalog (CSV, Excel) Import" (simpleimportproduct) <= 6.7.0 from MyPrestaModules for PrestaShop, a guest can upload files with extensions .php.
- 7.5 High severity
Orders (csv, Excel) Export Pro: Missing Authorization
In the module "Orders (CSV, Excel) Export PRO" (ordersexport) < 5.2.0 from MyPrestaModules for PrestaShop, a guest can download personal information without restriction. Due to a lack of permissions control, a guest can access exports from the module which can
- 9.8 Critical severity
Updateproducts: Improper Neutralization of Special Elements used in an SQL Command
In the module "Product Catalog (CSV, Excel) Export/Update" (updateproducts) < 3.8.5 from MyPrestaModules for PrestaShop, a guest can perform SQL injection. The method `productsUpdateModel::getExportIds()` has sensitive SQL calls that can be executed with a tri
- 9.8 Critical severity
Cross Selling In Modal Cart: Improper Neutralization of Special Elements used in an SQL Command
In the module "Cross Selling in Modal Cart" (motivationsale) < 3.5.0 from MyPrestaModules for PrestaShop, a guest can perform SQL injection. The method `motivationsaleDataModel::getProductsByIds()` has sensitive SQL calls that can be executed with a trivial ht
- 9.8 Critical severity
Exportproducts: Improper Neutralization of Special Elements used in an SQL Command
In the module "Product Catalog (CSV, Excel, XML) Export PRO" (exportproducts) in versions up to 5.0.0 from MyPrestaModules for PrestaShop, a guest can perform SQL injection via `exportProduct::_addDataToDb().`
- 8.8 High severity
Orders (csv, Excel) Export Pro: Improper Neutralization of Special Elements used in an SQL Command
MyPrestaModules ordersexport before v5.0 was discovered to contain multiple SQL injection vulnerabilities at send.php via the key and save_setting parameters.
- 7.5 High severity
exportproducts: Improper Limitation of a Pathname to a Restricted Directory
In the module "Product Catalog (CSV, Excel, XML) Export PRO" (exportproducts) in versions up to 4.1.1 from MyPrestaModules for PrestaShop, a guest can download personal information without restriction by performing a path traversal attack. Due to a lack of per
- 7.5 High severity
Product Catalog (csv, Excel) Import: Exposure of Sensitive Information to an Unauthorized Actor
MyPrestaModules Prestashop Module v6.2.9 and UpdateProducts Prestashop Module v3.6.9 were discovered to contain a PHPInfo information disclosure vulnerability via send.php.
- 9.8 Critical severity
Frequently Asked Questions Page: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability found in PrestaSHp faqs v.3.1.6 allows a remote attacker to escalate privileges via the faqsBudgetModuleFrontController::displayAjaxGenerateBudget component.