Aimeos Pagible content management system versions prior to 0.10.4 contain a Server-Side Request Forgery (SSRF) vulnerability via DNS Rebinding in the administrative proxy route (cmsproxy). A Time-of-Check to Time-of-Use (TOCTOU) race condition allows attackers to access internal network resources and cloud metadata endpoints. The vulnerability is caused by a weakness in the URL validation phase, which can [truncated]
Aimeos Laravel ecommerce platform 2021.10 LTS contains a SQL injection vulnerability in the json api 'sort' parameter. Attackers can manipulate the sort parameter to inject malicious database queries and reveal table and column names by sending crafted GET requests to the jsonapi/review endpoint. This vulnerability allows attackers to potentially expose sensitive data and disrupt ecommerce operations. Def [truncated]
