Prestashopmodules vulnerabilities
We track 8 vulnerabilities in Prestashopmodules products across 7 products. 8 are rated high or critical, and none are known to be exploited. The most recent was published on June 24, 2024.
Latest Prestashopmodules vulnerabilities
- 7.5 High severity
themesettings: Exposure of Private Personal Information to an Unauthorized Actor
In the module "Theme settings" (pk_themesettings) <= 1.8.8 from Promokit.eu for PrestaShop, a guest can download all email collected while SHOP is in maintenance mode. Due to a lack of permissions control, a guest can access the txt file which collect email wh
- 9.8 Critical severity
jamarketplace: Unrestricted Upload of File with Dangerous Type
In the module "JA Marketplace" (jamarketplace) up to version 9.0.1 from JA Module for PrestaShop, a guest can upload files with extensions .php. In version 6.X, the method `JmarketplaceproductModuleFrontController::init()` and in version 8.X, the method `Jmark
- 9.8 Critical severity
mdgiftproduct: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection vulnerability in Digincube mdgiftproduct before 1.4.1 allows an attacker to run arbitrary SQL commands via the MdGiftRule::addGiftToCart method.
- 7.5 High severity
Apaczka: Files or Directories Accessible to External Parties
Improper access control vulnerability in Apaczka plugin for PrestaShop allows information gathering from saved templates without authentication.This issue affects Apaczka plugin for PrestaShop from v1 through v4.
- 9.8 Critical severity
bestkit_popup: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in Best-Kit bestkit_popup v.1.7.2 and before allows a remote attacker to escalate privileges via the bestkit_popup.php component.
- 9.8 Critical severity
productdesigner: Deserialization of Untrusted Data
An issue was discovered in Tunis Soft "Product Designer" (productdesigner) module for PrestaShop before version 1.178.36, allows remote attackers to execute arbitrary code, escalate privileges, and obtain sensitive information via the postProcess() method.
- 7.5 High severity
productdesigner: Improper Limitation of a Pathname to a Restricted Directory
Path Traversal vulnerability in Tunis Soft "Product Designer" (productdesigner) module for PrestaShop before version 1.178.36, allows a remote attacker to escalate privileges and obtain sensitive information via the ajaxProcessCropImage() method.
- 9.8 Critical severity
Sliding Cart Block: Improper Neutralization of Special Elements used in an SQL Command
In the module "Sliding cart block" (blockslidingcart) up to version 2.3.8 from PrestashopModules.eu for PrestaShop, a guest can perform SQL injection.