PrestaShop

9 results · Clear filters · Feed

• Critical 9.3
  CVE-2026-44212 Public exploit

  PrestaShop: Stored XSS executable in customer service view

  PrestaShop is an open source e-commerce web application. Prior to 8.2.6 and 9.1.1, there is a stored Cross-Site Scripting (XSS) vulnerability in the PrestaShop back-office Customer Service view. An unauthenticated attacker can submit the public Contact Us for…

  PrestaShop PrestaShop prestashop/prestashop Web / CMS Packagist
  May 14, 2026
• Critical 9.7
  CVE-2024-34716 Public exploit EPSS 59%

  PrestaShop vulnerable to XSS via customer contact form in FO, through file upload

  PrestaShop is an open source e-commerce web application. A cross-site scripting (XSS) vulnerability that only affects PrestaShops with customer-thread feature flag enabled is present starting from PrestaShop 8.1.0 and prior to PrestaShop 8.1.6. When the custo…

  PrestaShop PrestaShop prestashop/prestashop Web / CMS Packagist
  May 14, 2024
• Critical 9.1
  CVE-2023-39526 Public exploit

  PrestaShopSQL manager vulnerability (potential RCE)

  PrestaShop is an open source e-commerce web application. Versions prior to 1.7.8.10, 8.0.5, and 8.1.1 are vulnerable to remote code execution through SQL injection and arbitrary file write in the back office. Versions 1.7.8.10, 8.0.5, and 8.1.1 contain a patc…

  PrestaShop PrestaShop prestashop/prestashop Web / CMS Packagist
  Aug 7, 2023
• Critical 10.0
  CVE-2023-30839 Public exploit

  PrestaShop vulnerable to SQL filter bypass leading to arbitrary write requests using "SQL Manager"

  PrestaShop is an Open Source e-commerce web application. Versions prior to 8.0.4 and 1.7.8.9 contain a SQL filtering vulnerability. A BO user can write, update, and delete in the database, even without having specific rights. PrestaShop 8.0.4 and 1.7.8.9 cont…

  PrestaShop PrestaShop prestashop/prestashop Web / CMS Packagist
  Apr 25, 2023
• Critical 9.8
  CVE-2022-31181 Public exploit Scanner template

  Remote code execution in prestashop

  PrestaShop is an Open Source e-commerce platform. In versions from 1.6.0.10 and before 1.7.8.7 PrestaShop is subject to an SQL injection vulnerability which can be chained to call PHP's Eval function on attacker input. The problem is fixed in version 1.7.8.7.…

  PrestaShop PrestaShop prestashop/prestashop Web / CMS Packagist
  Aug 1, 2022
• High 8.1
  CVE-2022-31101 Public exploit Scanner template EPSS 23%

  SQL Injection in prestashop/blockwishlist

  prestashop/blockwishlist is a prestashop extension which adds a block containing the customer's wishlists. In affected versions an authenticated customer can perform SQL injection. This issue is fixed in version 2.1.1. Users are advised to upgrade. There are …

  PrestaShop blockwishlist prestashop/blockwishlist Packagist
  Jun 27, 2022
• High 7.5
  CVE-2021-43789 Public exploit

  Blind SQLi using Search filters in PrestaShop

  PrestaShop is an Open Source e-commerce web application. Versions of PrestaShop prior to 1.7.8.2 are vulnerable to blind SQL injection using search filters with `orderBy` and `sortOrder` parameters. The problem is fixed in version 1.7.8.2.

  PrestaShop PrestaShop prestashop/prestashop Web / CMS Packagist
  Dec 7, 2021
• Unscored —
  CVE-2020-15160 Public exploit EPSS 11%

  Blind SQL Injection in PrestaShop

  PrestaShop from version 1.7.5.0 and before version 1.7.6.8 is vulnerable to a blind SQL Injection attack in the Catalog Product edition page with location parameter. The problem is fixed in 1.7.6.8

  PrestaShop PrestaShop Web / CMS
  Sep 24, 2020
• High 7.6
  CVE-2020-5250 Public exploit

  Possible information disclosure in PrestaShop

  In PrestaShop before version 1.7.6.4, when a customer edits their address, they can freely change the id_address in the form, and thus steal someone else's address. It is the same with CustomerForm, you are able to change the id_customer and change all inform…

  PrestaShop PrestaShop Web / CMS
  Mar 5, 2020