Priority HIGH 82
An issue in Prestashop v.8.1.7 and before allows a remote attacker to execute arbitrary code via the module upgrade functionality.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01263 · Published 2024-08-12 · No fix listed CWE-94
Priority HIGH 82
Prestashop posstaticfooter <= 1.0.0 is vulnerable to SQL Injection via posstaticfooter::getPosCurrentHook().
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.32413 · Published 2023-05-10 · No fix listed CWE-89
Priority HIGH 82
Prestashop possearchproducts 1.7 is vulnerable to SQL Injection via PosSearch::find().
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02678 · Published 2023-05-11 · No fix listed CWE-89
Priority HIGH 82
PrestaShop dpdfrance <6.1.3 is vulnerable to SQL Injection via dpdfrance/ajax.php.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0089 · Published 2023-03-13 · No fix listed CWE-89
Priority HIGH 76
PrestaShop is an open source e-commerce web application.
CVSS 3.1CRITICAL 9.7· Network · No auth · User interaction · EPSS 0.56445 · Published 2024-05-14 · Fixed in 8.1.6 CWE-79
Priority HIGH 75
An SQL injection vulnerability in the Payplug (payplug) module for PrestaShop, in versions 3.6.0, 3.6.1, 3.6.2, 3.6.3, 3.7.0 and 3.7.1, allows remote attackers to execute arbitrary SQL commands via the ajax.php front con…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01038 · Published 2023-07-18 · No fix listed CWE-89
Priority HIGH 75
The eo_tags package before 1.3.0 for PrestaShop allows SQL injection via an HTTP User-Agent or Referer header.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00872 · Published 2023-03-21 · No fix listed CWE-89
Priority HIGH 73
PrestaShop ws_productreviews < 3.6.2 is vulnerable to SQL Injection.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.009 · Published 2023-03-14 · No fix listed CWE-89
Priority HIGH 73
In the module "Xen Forum" (xenforum) for PrestaShop, an authenticated user can perform SQL injection in versions up to 2.13.0.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00882 · Published 2023-03-06 · No fix listed CWE-89
Priority HIGH 73
prestashop/blockwishlist is a prestashop extension which adds a block containing the customer's wishlists.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.23492 · Published 2022-06-27 · Fixed in 2.1.1 CWE-89
Priority HIGH 73
modules/bamegamenu/ajax_phpcode.php in the Responsive Mega Menu (Horizontal+Vertical+Dropdown) Pro module 1.0.32 for PrestaShop 1.5.5.0 through 1.7.2.5 allows remote attackers to execute arbitrary PHP code via the code p…
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.50398 · Published 2018-03-28 · No fix listed CWE-94
Priority MEDIUM 64
A PHAR deserialization vulnerability in the _getHeaders function of PrestaShop v8.2.0 allows attackers to execute arbitrary code via a crafted POST request.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00731 · Published 2025-07-30 · No fix listed CWE-502
Priority MEDIUM 62
PrestaShop 1.6.x before 1.6.1.23 and 1.7.x before 1.7.4.4 allows remote attackers to execute arbitrary code via a file upload.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.22535 · Published 2018-11-09 · No fix listed CWE-434
Priority MEDIUM 60
The store system in PrestaShop 1.7.7.0 allows time-based boolean SQL injection via the module=productcomments controller=CommentGrade id_products[] parameter.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.18653 · Published 2021-01-20 · No fix listed CWE-89
Priority MEDIUM 58
PrestaShop is an Open Source e-commerce platform.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.06662 · Published 2022-08-01 · Fixed in 1.7.8.7 CWE-74
Priority MEDIUM 57
PrestaShop blockwishlist through 3.0.2 fails to validate wishlist ownership in the getUrlByIdWishListAction method, allowing authenticated customers to retrieve share tokens for any wishlist by identifier.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00342 · Published 2026-09-16 · No fix listed CWE-639
Priority MEDIUM 57
PrestaShop psgdpr versions through 1.4.3 fail to validate that GDPR consent log entries are attributed to the authenticated customer.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00354 · Published 2026-09-16 · No fix listed CWE-639
Priority MEDIUM 56
PrestaShop before 1.6.1.20 and 1.7.x before 1.7.3.4 mishandles cookie encryption in Cookie.php, Rinjdael.php, and Blowfish.php.
CVSS 3.0CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.16464 · Published 2018-07-09 · No fix listed
Priority MEDIUM 55
PrestaShop from version 1.7.5.0 and before version 1.7.6.8 is vulnerable to a blind SQL Injection attack in the Catalog Product edition page with location parameter.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.10807 · Published 2020-09-24 · Fixed in 1.7.6.8 CWE-89
Priority MEDIUM 52
PrestaShop is an open source e-commerce web application.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01693 · Published 2023-08-07 · Fixed in 1.7.8.10, 8.0.5 +1 CWE-89
Priority MEDIUM 51
An issue was discoverd in file controllers/admin/AdminLoginController.php in PrestaShop before 8.2.1 allowing attackers to gain sensitive information via the reset password feature.
CVSS 3.1LOW 3.7· Network · No auth · No interaction · EPSS 0.00816 · Published 2025-09-08 · Fixed in 8.2.3 CWE-359
Priority MEDIUM 50
PrestaShop ps_facetedsearch is a module that adds layered navigation filters.
CVSS 3.1CRITICAL 10.0· Network · No auth · No interaction · EPSS 0.0075 · Published 2026-07-17 · Fixed in 4.0.4 CWE-74
Priority MEDIUM 50
In the module "Import/Update Bulk Product from any Csv/Excel File Pro" (ba_importer) up to version 1.1.28 from Buy Addons for PrestaShop, a guest can perform SQL injection in affected versions.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00574 · Published 2024-02-27 · No fix listed CWE-89
Priority MEDIUM 50
PrestaShop is an Open Source e-commerce web application.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.04699 · Published 2021-12-07 · Fixed in 1.7.8.2 CWE-89
Priority MEDIUM 50
In the PrestaShop module "productcomments" before version 4.2.1, an attacker can use a Blind SQL injection to retrieve data or stop the MySQL service.
CVSS 3.1HIGH 8.2· Network · No auth · No interaction · EPSS 0.12388 · Published 2020-12-03 · Fixed in 4.2.1 CWE-89
Load more
THREATIST.IORead the docs