CVE-2020-12120

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The Correos Express addon for PrestaShop 1.6 through 1.7 allows remote attackers to obtain sensitive information, such as a service's owner password that can be used to modify orders via SOAP. Attackers can also retrieve information about orders or buyers.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-732

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://addons.prestashop.com/en/delivery-date/27273-correos-express-solutions-of-urgent-transport.htmlVendor Advisory
https://ia-informatica.com/it/CVE-2020-12120Exploit, Third Party Advisory
https://addons.prestashop.com/en/delivery-date/27273-correos-express-solutions-of-urgent-transport.htmlVendor Advisory
https://ia-informatica.com/it/CVE-2020-12120Exploit, Third Party Advisory

Timeline

Published: Apr 27, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-121227.8In Max Secure Max Spyware Detector 1.0.0.044, the driver file (MaxProc64.sys) allows local users to cause a denial of service (BSOD) or poss CVE-2020-121238.1CSRF vulnerabilities in the /cgi-bin/ directory of the WAVLINK WN530H4 M30H4.V5030.190403 allow an attacker to remotely access router endpoi CVE-2020-121249.8A remote command-line injection vulnerability in the /cgi-bin/live_api.cgi endpoint of the WAVLINK WN530H4 M30H4.V5030.190403 allows an atta CVE-2020-121259.8A remote buffer overflow vulnerability in the /cgi-bin/makeRequest.cgi endpoint of the WAVLINK WN530H4 M30H4.V5030.190403 allows an attacker CVE-2020-121269.8Multiple authentication bypass vulnerabilities in the /cgi-bin/ endpoint of the WAVLINK WN530H4 M30H4.V5030.190403 allow an attacker to leak CVE-2020-121277.5An information disclosure vulnerability in the /cgi-bin/ExportAllSettings.sh endpoint of the WAVLINK WN530H4 M30H4.V5030.190403 allows an at CVE-2020-121287.5DONG JOO CHO File Transfer iFamily 2.1 allows directory traversal related to the ./etc/ path.CVE-2020-121296.1The AirDisk Pro app 5.5.3 for iOS allows XSS via the createFolder parameter of the Create Folder function.CVE-2020-12137.5A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code Execut CVE-2020-121306.1The AirDisk Pro app 5.5.3 for iOS allows XSS via the deleteFile parameter of the Delete function.CVE-2020-121316.1The AirDisk Pro app 5.5.3 for iOS allows XSS via the devicename parameter (shown next to the UI logo).CVE-2020-121326.1Fifthplay S.A.M.I before 2019.3_HP2 allows unauthenticated stored XSS via a POST request.