Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

2,047 results · page 16 of 41

Feb 6, 2024A vulnerability classified as critical was found in Juanpao JPShop up to 1.5.02.CVE-2024-1261 · Other software · Juanpao · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in Juanpao JPShop up to 1.5.02. This vulnerability affects the function actionIndex of the file /api/controllers/merchant/app/ComboController.php of the component API. The manipulation of the argument pic_url leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-253000.
Product
JPShop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record note.zhaoj.in vuldb.com
Feb 6, 2024A vulnerability classified as critical has been found in Juanpao JPShop up to 1.5.02.CVE-2024-1260 · Other software · Juanpao · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in Juanpao JPShop up to 1.5.02. This affects the function actionIndex of the file /api/controllers/admin/app/ComboController.php of the component API. The manipulation of the argument pic_url leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252999.
Product
JPShop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record note.zhaoj.in vuldb.com
Feb 6, 2024A vulnerability was found in Juanpao JPShop up to 1.5.02.CVE-2024-1259 · Other software · Juanpao · reported by VulDBMedium 6.3
A vulnerability was found in Juanpao JPShop up to 1.5.02. It has been rated as critical. Affected by this issue is some unknown functionality of the file /api/controllers/admin/app/AppController.php of the component API. The manipulation of the argument app_pic_url leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-252998 is the identifier assigned to this vulnerability.
Product
JPShop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record note.zhaoj.in vuldb.com
Feb 6, 2024A vulnerability was found in Juanpao JPShop up to 1.5.02.CVE-2024-1258 · Other software · Juanpao · reported by VulDBLow 3.1
A vulnerability was found in Juanpao JPShop up to 1.5.02. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file api/config/params.php of the component API. The manipulation of the argument JWT_KEY_ADMIN leads to use of hard-coded cryptographic key . The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier VDB-252997 was assigned to this vulnerability.
Product
JPShop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record note.zhaoj.in vuldb.com
Jan 26, 2024WordPress Simple Shopping Cart: Stored Cross-Site ScriptingCVE-2023-6497 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the automatic redirect URL setting in all versions up to and including 4.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
WordPress Simple Shopping Cart
Affected
up to 4.7.1
What to do
Affects up to 4.7.1. Update WordPress Simple Shopping Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 26, 2024A vulnerability was found in Niushop B2B2C V5 and classified as critical.CVE-2024-0933 · Other software · Niushop · reported by VulDBMedium 6.3
A vulnerability was found in Niushop B2B2C V5 and classified as critical. Affected by this issue is some unknown functionality of the file \app\model\Upload.php. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252140. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Product
B2B2C
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.qq.com vuldb.com
Jan 26, 2024An arbitrary file upload vulnerability in the component /alsdemo/ss/mediam.cgi of ShopSite v14.0 allows attackers to execute arbitrary code via uploading a crafCVE-2024-22550 · Other software · Shopsite · reported by MITREMedium 6.1
An arbitrary file upload vulnerability in the component /alsdemo/ss/mediam.cgi of ShopSite v14.0 allows attackers to execute arbitrary code via uploading a crafted SVG file.
Product
Shopsite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Jan 19, 2024A vulnerability, which was classified as critical, was found in Hecheng Leadshop up to 1.4.20.CVE-2024-0739 · Other software · Hecheng · reported by VulDBHigh 7.3
A vulnerability, which was classified as critical, was found in Hecheng Leadshop up to 1.4.20. Affected is an unknown function of the file /web/leadshop.php. The manipulation of the argument install leads to deserialization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-251562 is the identifier assigned to this vulnerability.
Product
Leadshop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record note.zhaoj.in vuldb.com
Jan 19, 2024In the module "Jms Setting" (jmssetting) from Joommasters for PrestaShop, a guest can perform SQL injection in versions <= 1.1.0.CVE-2023-50030 · Other software · Joommasters · reported by MITRECritical 9.8
In the module "Jms Setting" (jmssetting) from Joommasters for PrestaShop, a guest can perform SQL injection in versions <= 1.1.0. The method `JmsSetting::getSecondImgs()` has a sensitive SQL call that can be executed with a trivial http call and exploited to forge a blind SQL injection.
Product
Jmssetting
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.friendsofpresta.org joommasters.com
Jan 19, 2024In the module "Sliding cart block" (blockslidingcart) up to version 2.3.8 from PrestashopModules.eu for PrestaShop, a guest can perform SQL injection.CVE-2023-50028 · Websites & servers · Prestashopmodules · reported by MITRECritical 9.8
In the module "Sliding cart block" (blockslidingcart) up to version 2.3.8 from PrestashopModules.eu for PrestaShop, a guest can perform SQL injection.
Product
Sliding Cart Block
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record addons.prestashop.com security.friendsofpresta.org
Jan 19, 2024In the module mib < 1.6.1 from MyPresta.eu for PrestaShop, a guest can perform SQL injection.CVE-2023-46351 · Other software · Mypresta · reported by MITRECritical 9.8
In the module mib < 1.6.1 from MyPresta.eu for PrestaShop, a guest can perform SQL injection. The methods `mib::getManufacturersByCategory()` has sensitive SQL calls that can be executed with a trivial http call and exploited to forge a SQL injection.
Product
Manufacturers (brands) Images Block
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mypresta.eu security.friendsofpresta.org
Jan 17, 2024URL Shortener by MyThemeShop: Missing AuthorizationCVE-2023-23896 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in MyThemeShop URL Shortener by MyThemeShop.This issue affects URL Shortener by MyThemeShop: from n/a through 1.0.17.
Product
URL Shortener by MyThemeShop
Affected
up to 1.0.17
What to do
Affects up to 1.0.17. Update URL Shortener by MyThemeShop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 16, 2024Shopware is an open headless commerce platform.CVE-2024-22408 · Other software · shopware · reported by GitHubHigh 7.6
Shopware is an open headless commerce platform. The implemented Flow Builder functionality in the Shopware application does not adequately validate the URL used when creating the “call webhook” action. This enables malicious users to perform web requests to internal hosts. This issue has been fixed in the Commercial Plugin release 6.5.7.4 or with the Security Plugin. For installations with Shopware 6.4 the Security plugin is recommended to be installed and up to date. For older versions of 6.4 and 6.5 corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.
Product
shopware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 16, 2024Shopware is an open headless commerce platform.CVE-2024-22407 · Other software · shopware · reported by GitHubMedium 4.9
Shopware is an open headless commerce platform. In the Shopware CMS, the state handler for orders fails to sufficiently verify user authorizations for actions that modify the payment, delivery, and/or order status. Due to this inadequate implementation, users lacking 'write' permissions for orders are still able to change the order state. This issue has been addressed and users are advised to update to Shopware 6.5.7.4. For older versions of 6.1, 6.2, 6.3 and 6.4 corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.
Product
shopware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 16, 2024Shopware is an open headless commerce platform.CVE-2024-22406 · Other software · shopware · reported by GitHubCritical 9.3
Shopware is an open headless commerce platform. The Shopware application API contains a search functionality which enables users to search through information stored within their Shopware instance. The searches performed by this function can be aggregated using the parameters in the “aggregations” object. The ‘name’ field in this “aggregations” object is vulnerable SQL-injection and can be exploited using time-based SQL-queries. This issue has been addressed and users are advised to update to Shopware 6.5.7.4. For older versions of 6.1, 6.2, 6.3 and 6.4 corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.
Product
shopware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 16, 2024An issue in 202 ecommerce Advanced Loyalty Program: Loyalty Points before v2.3.4 for PrestaShop allows unauthenticated attackers to arbitrarily change an order CVE-2023-48926 · Websites & servers · Prestashop · reported by MITREMedium 5.3
An issue in 202 ecommerce Advanced Loyalty Program: Loyalty Points before v2.3.4 for PrestaShop allows unauthenticated attackers to arbitrarily change an order status.
Product
Advanced Loyalty Program
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 16, 2024Ecwid Ecommerce Shopping Cart: Does not have CSRF check in placeCVE-2023-6292 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Ecwid Ecommerce Shopping Cart WordPress plugin before 6.12.5 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
Product
Ecwid Ecommerce Shopping Cart
Fixed in
6.12.5
What to do
Update Ecwid Ecommerce Shopping Cart to 6.12.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2024WPGraphQL WooCommerce: Does not prevent unauthenticated attackers from enumerating a shop's coupon codes and values via GraphQLCVE-2022-1563 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WPGraphQL WooCommerce WordPress plugin before 0.12.4 does not prevent unauthenticated attackers from enumerating a shop's coupon codes and values via GraphQL.
Product
WPGraphQL WooCommerce
Fixed in
0.12.4
What to do
Update WPGraphQL WooCommerce to 0.12.4 or newer.
Full record and what to do →NVD record github.com wpscan.com
Jan 12, 2024An issue was discovered in NPM's package @evershop/evershop before version 1.0.0-rc.8.CVE-2023-46943 · Other software · Evershop · reported by MITRECritical 9.1
An issue was discovered in NPM's package @evershop/evershop before version 1.0.0-rc.8. The HMAC secret used for generating tokens is hardcoded as "secret". A weak HMAC secret poses a risk because attackers can use the predictable secret to create valid JSON Web Tokens (JWTs), allowing them access to important information and actions within the application.
Product
Evershop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisory.checkmarx.net devhub.checkmarx.com
Jan 12, 2024Lack of authentication in NPM's package @evershop/evershop before version 1.0.0-rc.8, allows remote attackers to obtain sensitive information via improper authoCVE-2023-46942 · Other software · Evershop · reported by MITREHigh 7.5
Lack of authentication in NPM's package @evershop/evershop before version 1.0.0-rc.8, allows remote attackers to obtain sensitive information via improper authorization in GraphQL endpoints.
Product
Evershop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisory.checkmarx.net devhub.checkmarx.com
Jan 11, 2024A vulnerability, which was classified as critical, was found in DeShang DSShop up to 2.1.5.CVE-2024-0417 · Other software · DeShang · reported by VulDBMedium 5.4
A vulnerability, which was classified as critical, was found in DeShang DSShop up to 2.1.5. This affects an unknown part of the file application/home/controller/MemberAuth.php. The manipulation of the argument member_info leads to path traversal: '../filedir'. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250437 was assigned to this vulnerability.
Product
DSShop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record note.zhaoj.in vuldb.com
Jan 11, 2024A vulnerability was found in DeShang DSShop up to 3.1.0.CVE-2024-0412 · Other software · DeShang · reported by VulDBMedium 5.3
A vulnerability was found in DeShang DSShop up to 3.1.0. It has been declared as problematic. This vulnerability affects unknown code of the file public/install.php of the component HTTP GET Request Handler. The manipulation leads to improper access controls. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250432.
Product
DSShop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record note.zhaoj.in vuldb.com
Jan 11, 2024A denial service vulnerability has been found on Hex Workshop affecting version 6.7, an attacker could send a command line file arguments and control the StrucCVE-2024-0429 · Other software · Hex Workshop · reported by cve-coordination@incibe.esHigh 7.3
A denial service vulnerability has been found on Hex Workshop affecting version 6.7, an attacker could send a command line file arguments and control the Structured Exception Handler (SEH) records resulting in a service shutdown.
Product
Hex Workshop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record https https
Jan 11, 2024GTG Product Feed for Shopping: Unauthorized modification of dataCVE-2023-6638 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The GTG Product Feed for Shopping plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_settings' function in versions up to, and including, 1.2.4. This makes it possible for unauthenticated attackers to update plugin settings.
Product
GTG Product Feed for Shopping
Affected
up to 1.2.4
What to do
Affects up to 1.2.4. Update GTG Product Feed for Shopping to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 9, 2024A vulnerability classified as critical was found in Likeshop up to 2.5.7.20210311.CVE-2024-0352 · Other software · Likeshop · reported by VulDBHigh 7.3
A vulnerability classified as critical was found in Likeshop up to 2.5.7.20210311. This vulnerability affects the function FileServer::userFormImage of the file server/application/api/controller/File.php of the component HTTP POST Request Handler. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250120.
Product
Likeshop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record note.zhaoj.in vuldb.com
Jan 8, 2024Blind SQL Injection vulnerability in PrestaShow Google Integrator (PrestaShop addon) allows for data extraction and modification.CVE-2023-6921 · Other software · PrestaShow · reported by cvd@cert.plCritical 9.8
Blind SQL Injection vulnerability in PrestaShow Google Integrator (PrestaShop addon) allows for data extraction and modification. This attack is possible via command insertion in one of the cookies.
Product
PrestaShop Google Integrator
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.pl cert.pl
Jan 8, 2024User-defined script code could be stored for a upsell related shop URL.CVE-2023-41710 · Other software · Open-Xchange GmbH · reported by security@open-xchange.comMedium 5.4
User-defined script code could be stored for a upsell related shop URL. This code was not correctly sanitized when adding it to DOM. Attackers could lure victims to user accounts with malicious script code and make them execute it in the context of a trusted domain. We added sanitization for this content. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.open-xchange.com software.open-xchange.com
Jan 8, 2024Users were able to define disclaimer texts for an upsell shop dialog that would contain script code that was not sanitized correctly.CVE-2023-29052 · Other software · Open-Xchange GmbH · reported by security@open-xchange.comMedium 5.4
Users were able to define disclaimer texts for an upsell shop dialog that would contain script code that was not sanitized correctly. Attackers could lure victims to user accounts with malicious script code and make them execute it in the context of a trusted domain. We added sanitization for this content. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.open-xchange.com software.open-xchange.com
Jan 5, 2024SQL Injection vulnerability in Buy Addons baproductzoommagnifier module for PrestaShop versions 1.0.16 and before, allows remote attackers to escalate privilegeCVE-2023-50027 · Other software · Buy-addons · reported by MITRECritical 9.8
SQL Injection vulnerability in Buy Addons baproductzoommagnifier module for PrestaShop versions 1.0.16 and before, allows remote attackers to escalate privileges and gain sensitive information via BaproductzoommagnifierZoomModuleFrontController::run() method.
Product
Bazoom Magnifier
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.friendsofpresta.org security.friendsofpresta.org
Jan 2, 2024PrestaShop is an open-source e-commerce platform.CVE-2024-21628 · Websites & servers · PrestaShop · reported by GitHubMedium 5.4
PrestaShop is an open-source e-commerce platform. Prior to version 8.1.3, the isCleanHtml method is not used on this this form, which makes it possible to store a cross-site scripting payload in the database. The impact is low because the HTML is not interpreted in BO, thanks to twig's escape mechanism. In FO, the cross-site scripting attack is effective, but only impacts the customer sending it, or the customer session from which it was sent. This issue affects those who have a module fetching these messages from the DB and displaying it without escaping HTML. Version 8.1.3 contains a patch for this issue.
Product
PrestaShop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 2, 2024PrestaShop is an open-source e-commerce platform.CVE-2024-21627 · Websites & servers · PrestaShop · reported by GitHubHigh 8.1
PrestaShop is an open-source e-commerce platform. Prior to versions 8.1.3 and 1.7.8.11, some event attributes are not detected by the `isCleanHTML` method. Some modules using the `isCleanHTML` method could be vulnerable to cross-site scripting. Versions 8.1.3 and 1.7.8.11 contain a patch for this issue. The best workaround is to use the `HTMLPurifier` library to sanitize html input coming from users. The library is already available as a dependency in the PrestaShop project. Beware though that in legacy object models, fields of `HTML` type will call `isCleanHTML`.
Product
PrestaShop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 28, 2023SQL Injection vulnerability in the Innovadeluxe Quick Order module for PrestaShop before v.1.4.0, allows local attackers to execute arbitrary code via the getPrCVE-2023-46989 · Other software · Innovadeluxe · reported by MITREHigh 7.8
SQL Injection vulnerability in the Innovadeluxe Quick Order module for PrestaShop before v.1.4.0, allows local attackers to execute arbitrary code via the getProducts() function in the productlist.php file.
Product
Quick Order
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.friendsofpresta.org security.friendsofpresta.org
Dec 14, 2023SQLi vulnerability in Starshop component for Joomla.CVE-2023-49708 · Other software · Joomstar.com · reported by security@joomla.orgCritical 9.8
SQLi vulnerability in Starshop component for Joomla.
Product
Starshop component for Joomla
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record extensions.joomla.org extensions.joomla.org
Dec 8, 2023Cross Site Scripting vulnerability in EverShop NPM versions before v.1.0.0-rc.5 allows a remote attacker to obtain sensitive information via a crafted scripts tCVE-2023-46499 · Other software · Evershop · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in EverShop NPM versions before v.1.0.0-rc.5 allows a remote attacker to obtain sensitive information via a crafted scripts to the Admin Panel.
Product
Evershop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record devhub.checkmarx.com devhub.checkmarx.com
Dec 8, 2023An issue in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information and execute arbitrary code via the /deleteCustomeCVE-2023-46498 · Other software · Evershop · reported by MITRECritical 9.8
An issue in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information and execute arbitrary code via the /deleteCustomer/route.json file.
Product
Evershop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record devhub.checkmarx.com devhub.checkmarx.com
Dec 8, 2023Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via a crafted request toCVE-2023-46497 · Other software · Evershop · reported by MITREMedium 5.4
Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via a crafted request to the mkdirSync function in the folderCreate/createFolder.js endpoint.
Product
Evershop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record devhub.checkmarx.com devhub.checkmarx.com
Dec 8, 2023Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via a crafted request toCVE-2023-46496 · Other software · Evershop · reported by MITREHigh 8.3
Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via a crafted request to the DELETE function in api/files endpoint.
Product
Evershop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record devhub.checkmarx.com devhub.checkmarx.com
Dec 8, 2023Cross Site Scripting vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via a crafted request tCVE-2023-46495 · Other software · Evershop · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via a crafted request to the sortBy parameter.
Product
Evershop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record devhub.checkmarx.com devhub.checkmarx.com
Dec 8, 2023Cross Site Scripting vulnerability in EverShop NPM versions before v.1.0.0-rc.5 allows a remote attacker to obtain sensitive information via a crafted request tCVE-2023-46494 · Other software · Evershop · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in EverShop NPM versions before v.1.0.0-rc.5 allows a remote attacker to obtain sensitive information via a crafted request to the ProductGrid function in admin/productGrid/Grid.jsx.
Product
Evershop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record devhub.checkmarx.com devhub.checkmarx.com
Dec 8, 2023Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via a crafted request toCVE-2023-46493 · Other software · Evershop · reported by MITREMedium 5.3
Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via a crafted request to the readDirSync function in fileBrowser/browser.js.
Product
Evershop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record devhub.checkmarx.com devhub.checkmarx.com
Dec 7, 2023An issue in DARTS SHOP MAXIM mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.CVE-2023-43301 · Other software · Linecorp · reported by MITREHigh 8.2
An issue in DARTS SHOP MAXIM mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.
Product
Line
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 6, 2023In the module "Orders (CSV, Excel) Export PRO" (ordersexport) < 5.2.0 from MyPrestaModules for PrestaShop, a guest can download personal information without resCVE-2023-46354 · Other software · Myprestamodules · reported by MITREHigh 7.5
In the module "Orders (CSV, Excel) Export PRO" (ordersexport) < 5.2.0 from MyPrestaModules for PrestaShop, a guest can download personal information without restriction. Due to a lack of permissions control, a guest can access exports from the module which can lead to a leak of personal information from ps_customer/ps_address tables such as name / surname / email / phone number / full postal address.
Product
Orders (csv, Excel) Export Pro
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.friendsofpresta.org security.friendsofpresta.org
Dec 6, 2023In the module "Product Tag Icons Pro" (ticons) before 1.8.4 from MyPresta.eu for PrestaShop, a guest can perform SQL injection.CVE-2023-46353 · Other software · Mypresta · reported by MITRECritical 9.8
In the module "Product Tag Icons Pro" (ticons) before 1.8.4 from MyPresta.eu for PrestaShop, a guest can perform SQL injection. The method TiconProduct::getTiconByProductAndTicon() has sensitive SQL calls that can be executed with a trivial http call and exploited to forge a SQL injection.
Product
Product TAG Icons Pro
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.friendsofpresta.org security.friendsofpresta.org
Dec 4, 2023A Cross-Site Scripting (XSS) vulnerability in the recipe preparation component within /api/objects/recipes and note component within /api/objects/shopping_listsCVE-2023-48866 · Other software · Grocy Project · reported by MITREMedium 5.4
A Cross-Site Scripting (XSS) vulnerability in the recipe preparation component within /api/objects/recipes and note component within /api/objects/shopping_lists/ of Grocy <= 4.0.3 allows attackers to obtain the victim's cookies.
Product
Grocy
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com nitipoom-jar.github.io
Nov 28, 2023Cross Site Scripting (XSS) in Search filters in Prestashop Amazzing filter version up to version 3.2.5, allows remote attackers to inject arbitrary JavaScript cCVE-2023-48042 · Other software · Communitydeveloper · reported by MITREMedium 6.1
Cross Site Scripting (XSS) in Search filters in Prestashop Amazzing filter version up to version 3.2.5, allows remote attackers to inject arbitrary JavaScript code.
Product
Amazzing Filter
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record addons.prestashop.com medium.com
Nov 27, 2023SQL injection vulnerability in PrestaShop opartdevis v.4.5.18 thru v.4.6.12 allows a remote attacker to execute arbitrary code via a crafted script to the getMoCVE-2023-48188 · Other software · Store-opart · reported by MITRECritical 9.8
SQL injection vulnerability in PrestaShop opartdevis v.4.5.18 thru v.4.6.12 allows a remote attacker to execute arbitrary code via a crafted script to the getModuleTranslation function.
Product
Op'art Devis
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.friendsofpresta.org security.friendsofpresta.org
Nov 27, 2023In the module "CSV Feeds PRO" (csvfeeds) < 2.6.1 from Bl Modules for PrestaShop, a guest can download personal information without restriction.CVE-2023-46355 · Other software · Blmodules · reported by MITREMedium 5.3
In the module "CSV Feeds PRO" (csvfeeds) < 2.6.1 from Bl Modules for PrestaShop, a guest can download personal information without restriction. Due to too permissive access control which does not force administrator to use password on feeds, a guest can access exports from the module which can lead to leaks of personal information from ps_customer / ps_order table such as name / surname / email / phone number / postal address.
Product
CSV Feeds Pro
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.friendsofpresta.org security.friendsofpresta.org
Nov 27, 2023In the module "Product Catalog (CSV, Excel) Export/Update" (updateproducts) < 3.8.5 from MyPrestaModules for PrestaShop, a guest can perform SQL injection.CVE-2023-46349 · Other software · Myprestamodules · reported by MITRECritical 9.8
In the module "Product Catalog (CSV, Excel) Export/Update" (updateproducts) < 3.8.5 from MyPrestaModules for PrestaShop, a guest can perform SQL injection. The method `productsUpdateModel::getExportIds()` has sensitive SQL calls that can be executed with a trivial http call and exploited to forge a SQL injection.
Product
Updateproducts
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.friendsofpresta.org security.friendsofpresta.org
Nov 22, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fla-shop.Com Interactive World Map plugin <= 3.2.0 versionCVE-2023-47767 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fla-shop.Com Interactive World Map plugin <= 3.2.0 versions.
Affected
up to 3.2.0
What to do
Affects up to 3.2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 22, 2023In the module "Cross Selling in Modal Cart" (motivationsale) < 3.5.0 from MyPrestaModules for PrestaShop, a guest can perform SQL injection.CVE-2023-46357 · Other software · Myprestamodules · reported by MITRECritical 9.8
In the module "Cross Selling in Modal Cart" (motivationsale) < 3.5.0 from MyPrestaModules for PrestaShop, a guest can perform SQL injection. The method `motivationsaleDataModel::getProductsByIds()` has sensitive SQL calls that can be executed with a trivial http call and exploited to forge a SQL injection.
Product
Cross Selling IN Modal Cart
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record addons.prestashop.com security.friendsofpresta.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.