Description
In PrestaShop before version 1.7.6.9 an attacker is able to list all the orders placed on the website without being logged by abusing the function that allows a shopping cart to be recreated from an order already placed. The problem is fixed in 1.7.6.9.
Remediation
References
Related Vulnerabilities
Moodle Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2013-4522)
Django Use of Cache Containing Sensitive Information Vulnerability (CVE-2026-6907)
Craft CMS Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability (CVE-2026-27128)
Apache HTTP Server Other Vulnerability (CVE-2000-1204)
Squid Integer Overflow or Wraparound Vulnerability (CVE-2020-11945)