Vulnerabilities

TI-2026-26054 CVE-2026-33674 · GHSA-283w-xf3q-788v

PrestaShop: Improper Use of Validation Framework

LOW 24

PrestaShop is an open source e-commerce web application.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00246 Published 2026-03-26 Fixed in 8.2.5, 9.1.0 CWE-1173

TI-2026-26053 CVE-2026-33673 · GHSA-35pf-37c6-jxjv

PrestaShop has multiple stored XSS vulnerabilities via unprotected Template variables

LOW 35

PrestaShop is an open source e-commerce web application.

CVSS 3.1HIGH 7.7 Network High privileges User interaction EPSS 0.00275 Published 2026-03-26 Fixed in 9.1.0, 8.2.5 CWE-79

TI-2026-20704 CVE-2026-25597 · GHSA-67v7-3g49-mxh2

PrestaShop has a time based enumeration in FO login form

LOW 30

PrestaShop is an open source e-commerce web application.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00312 Published 2026-02-06 Fixed in 8.2.4, 9.0.3 CWE-208

TI-2025-32369 CVE-2025-51586 · GHSA-8xx5-h6m3-jr33

An issue was discoverd in file controllers/admin/AdminLoginController.php in PrestaShop…

MEDIUM 51

An issue was discoverd in file controllers/admin/AdminLoginController.php in PrestaShop before 8.2.1 allowing attackers to gain sensitive information via the reset password feature.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00849 Published 2025-09-08 Fixed in 8.2.3 CWE-359

TI-2025-19098 CVE-2025-25692 · GHSA-wf46-fx4c-gx3r

A PHAR deserialization vulnerability in the _getHeaders function of PrestaShop v8.2.0…

MEDIUM 64

A PHAR deserialization vulnerability in the _getHeaders function of PrestaShop v8.2.0 allows attackers to execute arbitrary code via a crafted POST request.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00731 Published 2025-07-30 No fix listed CWE-502

TI-2025-19097 CVE-2025-25691 · GHSA-q2m3-hjgq-x5r2

A PHAR deserialization vulnerability in the component /themes/import of PrestaShop v8.2.0…

LOW 33

A PHAR deserialization vulnerability in the component /themes/import of PrestaShop v8.2.0 allows attackers to execute arbitrary code via a crafted POST request.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00931 Published 2025-07-30 No fix listed CWE-502

TI-2024-24358 CVE-2024-36626 · GHSA-866w-jmq2-r5wh

In prestashop 8.1.4, a NULL pointer dereference was identified in the math_round function within Tools.php.

LOW 31

In prestashop 8.1.4, a NULL pointer dereference was identified in the math_round function within Tools.php.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00655 Published 2024-11-29 No fix listed CWE-476

TI-2024-27717 CVE-2024-41651 · GHSA-9f68-5hcg-8ww5

An issue in Prestashop v.8.1.7 and before allows a remote attacker to execute arbitrary…

HIGH 82

An issue in Prestashop v.8.1.7 and before allows a remote attacker to execute arbitrary code via the module upgrade functionality.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01263 Published 2024-08-12 No fix listed CWE-94

TI-2024-23014 CVE-2024-34717 · GHSA-7pjr-2rgh-fc5g

Anonymous PrestaShop customer can download other customers' invoices

LOW 31

PrestaShop is an open source e-commerce web application.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00525 Published 2024-05-14 Fixed in 8.1.6 CWE-200

TI-2024-23013 CVE-2024-34716 · GHSA-45vm-3j38-7p78

PrestaShop vulnerable to XSS via customer contact form in FO, through file upload

HIGH 76

PrestaShop is an open source e-commerce web application.

CVSS 3.1CRITICAL 9.7 Network No auth User interaction EPSS 0.56445 Published 2024-05-14 Fixed in 8.1.6 CWE-79

TI-2024-17220 CVE-2024-26129 · GHSA-3366-9287-7qpr

Prestashop vulnerable to path disclosure in JavaScript variable

LOW 33

PrestaShop is an open-source e-commerce platform.

CVSS 3.1MEDIUM 5.8 Network No auth No interaction EPSS 0.0061 Published 2024-02-19 Fixed in 8.1.4 CWE-22

TI-2024-14353 CVE-2024-21628 · GHSA-vr7m-r9vm-m4wf

XSS can be stored in DB from "add a message form" in order detail page (FO)

LOW 27

PrestaShop is an open-source e-commerce platform.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00389 Published 2024-01-02 Fixed in 8.1.3 CWE-79

TI-2024-14352 CVE-2024-21627 · GHSA-xgpm-q3mq-46rq

Some attribute not escaped in Validate::isCleanHTML method

LOW 38

PrestaShop is an open-source e-commerce platform.

CVSS 3.1HIGH 8.1 Network High privileges User interaction EPSS 0.00523 Published 2024-01-02 Fixed in 8.1.3, 1.7.8.11 CWE-20

TI-2023-23389 CVE-2023-43664 · GHSA-gvrg-62jp-rf7j

Employee without any access rights can list all installed modules in Prestashop

LOW 21

PrestaShop is an Open Source e-commerce web application.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00483 Published 2023-09-28 Fixed in 8.1.2 CWE-269

TI-2023-23388 CVE-2023-43663 · GHSA-6jmf-2pfc-q9m7

Improper Privilege Management in Prestashop

LOW 28

PrestaShop is an Open Source e-commerce web application.

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00416 Published 2023-09-28 Fixed in 8.1.2 CWE-269

TI-2023-20662 CVE-2023-39530 · GHSA-v4gr-v679-42p7

PrestaShop vulnerable to file deletion via CustomerMessage

MEDIUM 41

PrestaShop is an open source e-commerce web application.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00856 Published 2023-08-07 Fixed in 8.1.1 CWE-20

TI-2023-20661 CVE-2023-39529 · GHSA-2rf5-3fw8-qm47

PrestaShop vulnerable to file deletion via attachment API

MEDIUM 40

PrestaShop is an open source e-commerce web application.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00713 Published 2023-08-07 Fixed in 8.1.1 CWE-20

TI-2023-20660 CVE-2023-39528 · GHSA-hpf4-v7v2-95p2

PrestaShop vulnerable to file reading through path traversal

LOW 39

PrestaShop is an open source e-commerce web application.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00755 Published 2023-08-07 Fixed in 8.1.1 CWE-22

TI-2023-20659 CVE-2023-39527 · GHSA-xw2r-f8xv-c8xp

PrestaShop XSS vulnerability through Validate::isCleanHTML method

LOW 37

PrestaShop is an open source e-commerce web application.

CVSS 3.1HIGH 8.3 Network High privileges User interaction EPSS 0.00513 Published 2023-08-07 Fixed in 1.7.8.10, 8.0.5 +1 CWE-116

TI-2023-20658 CVE-2023-39526 · GHSA-gf46-prm4-56pc

PrestaShopSQL manager vulnerability (potential RCE)

MEDIUM 52

PrestaShop is an open source e-commerce web application.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01693 Published 2023-08-07 Fixed in 1.7.8.10, 8.0.5 +1 CWE-89

TI-2023-20657 CVE-2023-39525 · GHSA-m9r4-3fg7-pqm2

PrestaShop vulnerable to path traversal

MEDIUM 41

PrestaShop is an open source e-commerce web application.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00864 Published 2023-08-07 Fixed in 8.1.1 CWE-22

TI-2023-20656 CVE-2023-39524 · GHSA-75p5-jwx4-qw9h

PrestaShop vulnerable to boolean SQL injection in search product in BO

MEDIUM 43

PrestaShop is an open source e-commerce web application.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00657 Published 2023-08-07 Fixed in 8.1.1 CWE-89

TI-2023-14619 CVE-2023-30839 · GHSA-p379-cxqh-q822

PrestaShop vulnerable to SQL filter bypass leading to arbitrary write requests using "SQL Manager"

MEDIUM 46

PrestaShop is an Open Source e-commerce web application.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.01706 Published 2023-04-25 Fixed in 8.0.4, 1.7.8.9 CWE-89

TI-2023-14618 CVE-2023-30838 · GHSA-fh7r-996q-gvcp

PrestaShop vulnerable to possible XSS injection through Validate::isCleanHTML method

MEDIUM 45

PrestaShop is an Open Source e-commerce web application.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.01045 Published 2023-04-25 Fixed in 8.0.4, 1.7.8.9 CWE-79

TI-2023-14380 CVE-2023-30545 · GHSA-8r4m-5p6p-52rp

PrestaShop arbitrary file read vulnerability

LOW 35

PrestaShop is an Open Source e-commerce web application.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00863 Published 2023-04-25 Fixed in 1.7.8.9, 8.0.4 CWE-89

Vulnerabilities

Filters