LeoTheme vulnerabilities

Products

• Ap Page Builder 1
• leo product search module 1
• leoblog 1
• leocustomajax 1

Latest LeoTheme CVEs

Newest publication first

1. CVE-2024-42697 Cross Site Scripting vulnerability in Leotheme Leo Product Search Module v.2.1.6 and earlier allows a remote attacker to execute arbitrary code via the q parameter of the product search function.

   Published 2024-09-20

   Medium·CVSS 6.1 EPSS 0.37%

   Cross Site Scripting vulnerability in Leotheme Leo Product Search Module v.2.1.6 and earlier allows a remote attacker to execute arbitrary code via the q parameter of the product search function.

2. CVE-2023-39639 LeoTheme leoblog up to v3.1.2 was discovered to contain a SQL injection vulnerability via the component LeoBlogBlog::getListBlogs.

   Published 2023-09-14

   Critical·CVSS 9.8 EPSS 0.81%

   LeoTheme leoblog up to v3.1.2 was discovered to contain a SQL injection vulnerability via the component LeoBlogBlog::getListBlogs.

3. CVE-2023-3743 SQL injection vulnerability in LeoTheme's Ap Page Builder

   Published 2023-07-18

   High·CVSS 7.5 EPSS 0.76%

   Ap Page Builder, in versions lower than 1.7.8.2, could allow a remote attacker to send a specially crafted SQL query to the product_one_img parameter to retrieve the information stored in the database.

4. CVE-2023-30150 PrestaShop leocustomajax 1.0 and 1.0.0 are vulnerable to SQL Injection via modules/leocustomajax/leoajax.php.

   Published 2023-06-14

   Critical·CVSS 9.8 EPSS 3.8%

   PrestaShop leocustomajax 1.0 and 1.0.0 are vulnerable to SQL Injection via modules/leocustomajax/leoajax.php.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.