Pallangyo98

3 exploits Active since Apr 2024
CVE-2023-47268 GITHUB MEDIUM WRITEUP
Prusa PrusaSlicer through 2.6.1 - Code Injection
In libslic3r/GCode/PostProcessor.cpp in Prusa PrusaSlicer through 2.6.1, a crafted 3mf project file can execute arbitrary code on a host where the project is sliced and G-code exported.
CVSS 5.3
CVE-2024-32651 GITHUB CRITICAL WRITEUP
changedetection.io <=0.45.20 - Remote Command Execution via Jinja2 SSTI
changedetection.io is an open source web page change detection, website watcher, restock monitor and notification service. There is a Server Side Template Injection (SSTI) in Jinja2 that allows Remote Command Execution on the server host. Attackers can run any system command without any restriction and they could use a reverse shell. The impact is critical as the attacker can completely takeover the server machine. This can be reduced if changedetection is behind a login page, but this isn't required by the application (not by default and not enforced).
CVSS 10.0
CVE-2024-34716 NOMISEC CRITICAL WRITEUP
PrestaShop 8.1.0-8.1.6 - Stored Cross-Site Scripting via Customer Thread Attachment
PrestaShop is an open source e-commerce web application. A cross-site scripting (XSS) vulnerability that only affects PrestaShops with customer-thread feature flag enabled is present starting from PrestaShop 8.1.0 and prior to PrestaShop 8.1.6. When the customer thread feature flag is enabled through the front-office contact form, a hacker can upload a malicious file containing an XSS that will be executed when an admin opens the attached file in back office. The script injected can access the session and the security token, which allows it to perform any authenticated action in the scope of the administrator's right. This vulnerability is patched in 8.1.6. A workaround is to disable the customer-thread feature-flag.
CVSS 9.6