peel

Top products

The 15 most recently published vulnerabilities affecting peel.

• CVE-2014-125061peel filebroker common.rb select_transfer_status_desc sql injection5.5Jan 7, 2023
• CVE-2021-41672PEEL Shopping CMS 9.4.0 is vulnerable to authenticated SQL injection in utilisateurs.php. A user that belongs to the administrator group can inject a malicious SQL query in order to affect the exec...6.5Jun 15, 2022
• CVE-2021-37593PEEL Shopping version 9.4.0 allows remote SQL injection. A public user/guest (unauthenticated) can inject a malicious SQL query in order to affect the execution of predefined SQL commands. Upon a s...9.1Jul 27, 2021
• CVE-2021-27190A Stored Cross Site Scripting(XSS) Vulnerability was discovered in PEEL SHOPPING 9.3.0 and 9.4.0, which are publicly available. The user supplied input containing polyglot payload is echoed back in...5.4Feb 12, 2021
• CVE-2019-20178Advisto PEEL Shopping 9.2.1 has CSRF via administrer/utilisateurs.php to delete a user.6.5Jan 9, 2020
• CVE-2018-20848Advisto PEEL SHOPPING 9.0.0 has CSRF via en/achat/caddie_ajout.php and en/achat/caddie_affichage.php, as demonstrated by an XSS payload in the couleurId[0] parameter to the latter.8.8Jun 30, 2019
• CVE-2018-1000887Peel shopping peel-shopping_9_1_0 version contains a Cross Site Scripting (XSS) vulnerability that can result in an authenticated user injecting java script code in the "Site Name EN" parameter. Th...4.8Dec 27, 2018
• CVE-2012-5226Multiple cross-site scripting (XSS) vulnerabilities in Peel SHOPPING 2.8 and 2.9 allow remote attackers to inject arbitrary web script or HTML via the (1) motclef parameter to achat/recherche.php o...4.3Oct 1, 2012
• CVE-2012-5227SQL injection vulnerability in administrer/tva.php in Peel SHOPPING 2.8 and 2.9 allows remote attackers to execute arbitrary SQL commands via the id parameter.7.5Oct 1, 2012
• CVE-2008-6892SQL injection vulnerability in lire/index.php in Peel 3.1 allows remote attackers to execute arbitrary SQL commands via the rubid parameter. NOTE: this might be the same issue as CVE-2005-3572.7.5Aug 3, 2009
• CVE-2008-1507PEEL, possibly 3.x and earlier, has (1) a default info@peel.fr account with password admin, and (2) a default contact@peel.fr account with password cinema, which allows remote attackers to gain adm...7.5Mar 25, 2008
• CVE-2008-1506PEEL, possibly 3.x and earlier, allows remote attackers to obtain configuration information via a direct request to phpinfo.php, which calls the phpinfo function.5.0Mar 25, 2008
• CVE-2008-1496Multiple SQL injection vulnerabilities in PEEL, possibly 3.x and earlier, allow remote attackers to execute arbitrary SQL commands via the (1) email parameter to (a) membre.php, and the (2) timesta...7.5Mar 25, 2008
• CVE-2008-1495Unrestricted file upload vulnerability in administrer/produits.php in PEEL, possibly 3.x and earlier, allows remote authenticated administrators to upload and execute arbitrary PHP files via a modi...6.5Mar 25, 2008
• CVE-2005-3572SQL injection vulnerability in index.php in Peel 2.6 through 2.7 allows remote attackers to execute arbitrary SQL commands via the rubid parameter.7.5Nov 16, 2005