Total
421292 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-30197 | 1 Webbax | 1 Myinventory | 2026-06-17 | N/A | 7.5 HIGH |
| Incorrect Access Control in the module "My inventory" (myinventory) <= 1.6.6 from Webbax for PrestaShop, allows a guest to download personal information without restriction by performing a path traversal attack. | |||||
| CVE-2023-30196 | 1 Webbax | 1 Salesbooster | 2026-06-17 | N/A | 7.5 HIGH |
| Prestashop salesbooster <= 1.10.4 is vulnerable to Incorrect Access Control via modules/salesbooster/downloads/download.php. | |||||
| CVE-2023-30195 | 1 Lineagrafica | 1 Lgdetailedorder | 2026-06-17 | N/A | 7.5 HIGH |
| In the module "Detailed Order" (lgdetailedorder) in version up to 1.1.20 from Linea Grafica for PrestaShop, a guest can download personal informations without restriction formatted in json. | |||||
| CVE-2023-30194 | 1 Prestashop | 1 Poststaticfooter | 2026-06-17 | N/A | 9.8 CRITICAL |
| Prestashop posstaticfooter <= 1.0.0 is vulnerable to SQL Injection via posstaticfooter::getPosCurrentHook(). | |||||
| CVE-2023-30192 | 1 Prestashop | 1 Possearchproducts | 2026-06-17 | N/A | 9.8 CRITICAL |
| Prestashop possearchproducts 1.7 is vulnerable to SQL Injection via PosSearch::find(). | |||||
| CVE-2023-30189 | 1 Posthemes | 1 Posstaticblocks | 2026-06-17 | N/A | 9.8 CRITICAL |
| Prestashop posstaticblocks <= 1.0.0 is vulnerable to SQL Injection via posstaticblocks::getPosCurrentHook(). | |||||
| CVE-2023-30184 | 1 Typecho | 1 Typecho | 2026-06-17 | N/A | 5.4 MEDIUM |
| A stored cross-site scripting (XSS) vulnerability in Typecho v1.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the url parameter at /index.php/archives/1/comment. | |||||
| CVE-2023-30179 | 1 Craftcms | 1 Craft Cms | 2026-06-17 | N/A | 7.2 HIGH |
| CraftCMS version 3.7.59 is vulnerable to Server-Side Template Injection (SSTI). An authenticated attacker can inject Twig Template to User Photo Location field when setting User Photo Location in User Settings, lead to Remote Code Execution. NOTE: the vendor disputes this because only Administrators can add this Twig code, and (by design) Administrators are allowed to do that by default. | |||||
| CVE-2023-30177 | 1 Craftcms | 1 Craft Cms | 2026-06-17 | N/A | 6.1 MEDIUM |
| CraftCMS 3.7.59 is vulnerable Cross Site Scripting (XSS). An attacker can inject javascript code into Volume Name. | |||||
| CVE-2023-30172 | 1 Lfprojects | 1 Mlflow | 2026-06-17 | N/A | 7.5 HIGH |
| A directory traversal vulnerability in the /get-artifact API method of the mlflow platform up to v2.0.1 allows attackers to read arbitrary files on the server via the path parameter. | |||||
| CVE-2023-30154 | 1 Shoprunners | 1 Aftermail | 2026-06-17 | N/A | 9.8 CRITICAL |
| Multiple improper neutralization of SQL parameters in module AfterMail (aftermailpresta) for PrestaShop, before version 2.2.1, allows remote attackers to perform SQL injection attacks via `id_customer`, `id_conf`, `id_product` and `token` parameters in `aftermailajax.php via the 'id_product' parameter in hooks DisplayRightColumnProduct and DisplayProductButtons. | |||||
| CVE-2023-30153 | 1 Prestashop | 1 Payplug | 2026-06-17 | N/A | 9.8 CRITICAL |
| An SQL injection vulnerability in the Payplug (payplug) module for PrestaShop, in versions 3.6.0, 3.6.1, 3.6.2, 3.6.3, 3.7.0 and 3.7.1, allows remote attackers to execute arbitrary SQL commands via the ajax.php front controller. | |||||
| CVE-2023-30151 | 1 Boxtal | 1 Envoimoinscher | 2026-06-17 | N/A | 9.8 CRITICAL |
| A SQL injection vulnerability in the Boxtal (envoimoinscher) module for PrestaShop, after version 3.1.10, allows remote attackers to execute arbitrary SQL commands via the `key` GET parameter. | |||||
| CVE-2023-30150 | 1 Leotheme | 1 Leocustomajax | 2026-06-17 | N/A | 9.8 CRITICAL |
| PrestaShop leocustomajax 1.0 and 1.0.0 are vulnerable to SQL Injection via modules/leocustomajax/leoajax.php. | |||||
| CVE-2023-30149 | 2 Ebewe, Prestashop | 2 City Autocomplete, Prestashop | 2026-06-17 | N/A | 9.8 CRITICAL |
| SQL injection vulnerability in the City Autocomplete (cityautocomplete) module from ebewe.net for PrestaShop, prior to version 1.8.12 (for PrestaShop version 1.5/1.6) or prior to 2.0.3 (for PrestaShop version 1.7), allows remote attackers to execute arbitrary SQL commands via the type, input_name. or q parameter in the autocompletion.php front controller. | |||||
| CVE-2023-30148 | 1 Store-opart | 1 Multi Html Block | 2026-06-17 | N/A | 6.1 MEDIUM |
| Multiple Stored Cross Site Scripting (XSS) vulnerabilities in Opart opartmultihtmlblock before version 2.0.12 and Opart multihtmlblock* version 1.0.0, allows remote authenticated users to inject arbitrary web script or HTML via the body_text or body_text_rude field in /sourcefiles/BlockhtmlClass.php and /sourcefiles/blockhtml.php. | |||||
| CVE-2023-30146 | 1 Assmann | 2 Ht-ip211hdp, Ht-ip211hdp Firmware | 2026-06-17 | N/A | 7.5 HIGH |
| Assmann Digitus Plug&View IP Camera HT-IP211HDP, version 2.000.022 allows unauthenticated attackers to download a copy of the camera's settings and the administrator credentials. | |||||
| CVE-2023-30145 | 1 Tuzitio | 1 Camaleon Cms | 2026-06-17 | N/A | 9.8 CRITICAL |
| Camaleon CMS v2.7.0 was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the formats parameter. | |||||
| CVE-2023-30135 | 1 Tenda | 2 Ac18, Ac18 Firmware | 2026-06-17 | N/A | 9.8 CRITICAL |
| Tenda AC18 v15.03.05.19(6318_)_cn was discovered to contain a command injection vulnerability via the deviceName parameter in the setUsbUnload function. | |||||
| CVE-2023-30132 | 1 Ixpdata | 1 Easyinstall | 2026-06-17 | N/A | 7.8 HIGH |
| An issue discovered in IXP Data EasyInstall 6.6.14907.0 allows attackers to gain escalated privileges via static Cryptographic Key. | |||||