CVE-2023-33493

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An Unrestricted Upload of File with Dangerous Type vulnerability in the Ajaxmanager File and Database explorer (ajaxmanager) module for PrestaShop through 2.3.0, allows remote attackers to upload dangerous files without restrictions.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://security.friendsofpresta.org/module/2023/07/28/ajaxmanager.htmlVendor Advisory
https://security.friendsofpresta.org/module/2023/07/28/ajaxmanager.htmlVendor Advisory

Timeline

Published: Aug 1, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-334956.1Craft CMS through 4.4.9 is vulnerable to HTML Injection.CVE-2023-334969.8xxl-rpc v1.7.0 was discovered to contain a deserialization vulnerability via the component com.xxl.rpc.core.remoting.net.impl.netty.codec.Ne CVE-2023-334988.8alist <=3.16.3 is vulnerable to Incorrect Access Control. Low privilege accounts can upload any file.CVE-2023-33507.5A Cryptographic Issue vulnerability has been found on IBERMATICA RPS, affecting version 2019. By firstly downloading the log file, an attack CVE-2023-335077.5KramerAV VIA GO² < 4.0.1.1326 is vulnerable to Unauthenticated arbitrary file read.CVE-2023-335089.8KramerAV VIA GO² < 4.0.1.1326 is vulnerable to unauthenticated file upload resulting in Remote Code Execution (RCE).CVE-2023-335099.8KramerAV VIA GO² < 4.0.1.1326 is vulnerable to SQL Injection.CVE-2023-335107.5Jeecg P3 Biz Chat 1.0.5 allows remote attackers to read arbitrary files through specific parameters.CVE-2023-335155.4SoftExpert Excellence Suite 2.1.9 is vulnerable to Cross Site Scripting (XSS) via query screens.CVE-2023-335177.5carRental 1.0 is vulnerable to Incorrect Access Control (Arbitrary File Read on the Back-end System).CVE-2023-335185.3emoncms v11 and later was discovered to contain an information disclosure vulnerability which allows attackers to obtain the web directory p CVE-2023-33524.3The Smush plugin for WordPress is vulnerable to unauthorized deletion of the resmush list due to a missing capability check on the delete_re