David Álvarez Robles

The issue is related to a directory traversal vulnerability. The `f` parameter is not properly checked in the resource "/m4pdf/pdf.php", allowing an attacker to download any file given its relative path. This could potentially enable an attacker to access sensitive files, such as "/etc/passwd", if they exist on the server.

The M4 PDF plugin for Prestashop sites is vulnerable to an arbitrary HTML Document crafting vulnerability. The resource "/m4pdf/pdf.php" uses templates to dynamically create documents. If the template does not exist, the application returns a fixed document with a message in mpdf format. An attacker could exploit this vulnerability by inputting a valid HTML/CSS document as the value of the `parameter`.

The issue allows an attacker to interact with the database, potentially enabling them to read, modify, and delete data, due to the use of concatenation in constructing SQL queries.

O problema decorre da falha do plugin em escapar adequadamente a URL da página atual antes de reutilizá-la em um atributo HTML, levando a uma vulnerabilidade de cross-site scripting refletido.

O tema Enfold para WordPress está afetado por uma vulnerabilidade de Cross-Site Scripting (XSS) refletido. Essa vulnerabilidade está presente nas versões do Enfold que utilizam o Avia Page Builder e são anteriores à versão 4.8.4.