https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2023-27640.htmlhttps://patchthecve.com/cve/CVE-2023-27640.htmlWed, 17 Jun 2026 05:45:39 +0000HIGH 7.5: An issue was discovered in the tshirtecommerce (aka Custom Product Designer) component 2.1.4 for PrestaShop. An HTTP request can be forged with the POST parameter type in the /tshirtecommerce/fonts.php endpoint, to allow a remote attacker to traverse directories on the system in order to open files https://patchthecve.com/cve/CVE-2023-27639.htmlhttps://patchthecve.com/cve/CVE-2023-27639.htmlWed, 17 Jun 2026 05:45:38 +0000HIGH 7.5: An issue was discovered in the tshirtecommerce (aka Custom Product Designer) component 2.1.4 for PrestaShop. An HTTP request can be forged with the POST parameter file_name in the tshirtecommerce/ajax.php?type=svg endpoint, to allow a remote attacker to traverse directories on the system in order tohttps://patchthecve.com/cve/CVE-2023-27638.htmlhttps://patchthecve.com/cve/CVE-2023-27638.htmlWed, 17 Jun 2026 05:45:38 +0000CRITICAL 9.8: An issue was discovered in the tshirtecommerce (aka Custom Product Designer) component 2.1.4 for PrestaShop. An HTTP request can be forged with a compromised tshirtecommerce_design_cart_id GET parameter in order to exploit an insecure parameter in the functions hookActionCartSave and updateCustomizahttps://patchthecve.com/cve/CVE-2023-27637.htmlhttps://patchthecve.com/cve/CVE-2023-27637.htmlWed, 17 Jun 2026 05:45:38 +0000CRITICAL 9.8: An issue was discovered in the tshirtecommerce (aka Custom Product Designer) component 2.1.4 for PrestaShop. An HTTP request can be forged with a compromised product_id GET parameter in order to exploit an insecure parameter in the front controller file designer.php, which could lead to a SQL inject