CVE-2024-28391: Fmemodules b2b Quick Order Form

Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days.

SQL injection vulnerability in FME Modules quickproducttable module for PrestaShop v.1.2.1 and before, allows a remote attacker to escalate privileges and obtain information via the readCsv(), displayAjaxProductChangeAttr, displayAjaxProductAddToCart, getSearchProducts, and displayAjaxProductSku methods.

Affected products

• Fmemodules b2b Quick Order Form: before 1.3.0 (fixed in 1.3.0)

Published 2024-03-14. Last modified 2026-06-17.