https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 25 Oct 2026 17:33:32 +0000 https://cve.radiocsirt.org/vuln/cnvd-2023-64630 cnvd-2023-64630 https://cve.radiocsirt.org/vuln/cnvd-2023-64630 https://cve.radiocsirt.org/vuln/euvd-2026-191955 EUVD-2026-191955 https://cve.radiocsirt.org/vuln/euvd-2026-191955 https://cve.radiocsirt.org/vuln/fkie_cve-2023-39528 <p>PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, the `displayAjaxEmailHTML` method can be used to read any file on the server, potentially even outside of the project if the server is not correctly configured. Version 8.1.1 contains a patch for this issue. There are no known workarounds.</p> <p>PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, the `displayAjaxEmailHTML` method can be used to read any file on the server, potentially even outside of the project if the server is not correctly configured. Version 8.1.1 contains a patch for this issue. There are no known workarounds.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-39528 https://cve.radiocsirt.org/vuln/ghsa-hpf4-v7v2-95p2 <p><strong>Affected:</strong> Packagist: prestashop/prestashop</p> <p>### Impact `displayAjaxEmailHTML` method can be used to read any file on the server, potentially even outside of the project if the server is not correctly configured.</p> <p>This vulnerability can be exacerbated when coupled with [CWE-502](https://cwe.mitre.org/data/definitions/502.html), which pertains to the Deserialization of Untrusted Data. Such a combination could potentially lead to a Remote Code Execution (RCE) vulnerability</p> <p>### Patches 8.1.1</p> <p>### Found by Aleksey Solovev (Positive Technologies)</p> <p>### Workarounds</p> <p>### References</p> <p><strong>Affected:</strong> Packagist: prestashop/prestashop</p> <p>### Impact `displayAjaxEmailHTML` method can be used to read any file on the server, potentially even outside of the project if the server is not correctly configured.</p> <p>This vulnerability can be exacerbated when coupled with [CWE-502](https://cwe.mitre.org/data/definitions/502.html), which pertains to the Deserialization of Untrusted Data. Such a combination could potentially lead to a Remote Code Execution (RCE) vulnerability</p> <p>### Patches 8.1.1</p> <p>### Found by Aleksey Solovev (Positive Technologies)</p> <p>### Workarounds</p> <p>### References</p> https://cve.radiocsirt.org/vuln/ghsa-hpf4-v7v2-95p2 https://cve.radiocsirt.org/vuln/gsd-2023-39528 gsd-2023-39528 https://cve.radiocsirt.org/vuln/gsd-2023-39528