CVE-2023-25170: unsafe CSRF token handling in PrestaShop — CSRF protection tokens
PrestaShop and CVE-2023-25170: a practical explanation of unsafe CSRF token handling in CSRF protection tokens, real-world…
// category
PrestaShop Security
Opinion, technical notes and research on web development, servers, performance and cyber security.
CVE-2022-46158: information disclosure in PrestaShop — uploads directory
PrestaShop and CVE-2022-46158: a practical explanation of information disclosure in uploads directory, real-world impact…
CVE-2022-31181: remote code execution in PrestaShop — SQL-injection-to-eval chain
PrestaShop and CVE-2022-31181: a practical explanation of remote code execution in SQL-injection-to-eval chain, real-world…
CVE-2020-21967: unsafe file upload in PrestaShop — catalog upload feature
PrestaShop and CVE-2020-21967: a practical explanation of unsafe file upload in catalog upload feature, real-world impact…
CVE-2022-21686: remote code execution in PrestaShop — legacy back-office Twig templates
PrestaShop and CVE-2022-21686: a practical explanation of remote code execution in legacy back-office Twig templates, real-world…
CVE-2021-43789: SQL injection in PrestaShop — search filter orderBy and sortOrder
PrestaShop and CVE-2021-43789: a practical explanation of SQL injection in search filter orderBy and sortOrder, real-world…
CVE-2021-21398: cross-site scripting (XSS) in PrestaShop — DataColumn Grid class
PrestaShop and CVE-2021-21398: a practical explanation of cross-site scripting (XSS) in DataColumn Grid class, real-world…
CVE-2021-21308: authentication weakness in PrestaShop — soft logout and session lifecycle
PrestaShop and CVE-2021-21308: a practical explanation of authentication weakness in soft logout and session lifecycle…
CVE-2021-21302: CSV formula injection in PrestaShop — back-office CSV exports
PrestaShop and CVE-2021-21302: a practical explanation of CSV formula injection in back-office CSV exports, real-world impact…
CVE-2021-3110: SQL injection in PrestaShop — productcomments CommentGrade controller
PrestaShop and CVE-2021-3110: a practical explanation of SQL injection in productcomments CommentGrade controller, real-world…