by Kastro
Paper/Archive/CVE-2023-39647

CVE-2023-39647

mitre — Improper neutralization of SQL parameter in Theme Volty CMS Category Product module for PrestaShop.

EPSS 0.6%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 50.6.506 × 2010.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Improper neutralization of SQL parameter in Theme Volty CMS Category Product module for PrestaShop. In the module “Theme Volty CMS Category Product” (tvcmscategoryproduct) up to version 4.0.1 from Theme Volty for PrestaShop, a guest can perform SQL injection in affected versions.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refsecurity.friendsofpresta.org/modules/2023/09/26/tvcmscategoryproduct.html