Vulnerabilities

TI-2026-58678 CVE-2026-85520 · GHSA-mxmh-vx83-qfxg

Unauthenticated arbitrary file write leading to RCE in gmfeed PrestaShop module

MEDIUM 50

Google Merchant Center Feed (gmfeed) module for PrestaShop is vulnerable to unauthenticated arbitrary file write in the feed.php endpoint.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00991 Published 2026-09-29 No fix listed CWE-73

TI-2023-24947 CVE-2023-46351 · GHSA-f55x-g4vm-mj7x

In the module mib < 1.6.1 from MyPresta.eu for PrestaShop, a guest can perform SQL…

MEDIUM 49

In the module mib < 1.6.1 from MyPresta.eu for PrestaShop, a guest can perform SQL injection.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00518 Published 2024-01-19 No fix listed CWE-89

TI-2023-24949 CVE-2023-46353 · GHSA-vqmp-4xrh-j6jq

In the module "Product Tag Icons Pro" (ticons) before 1.8.4 from MyPresta.eu for…

MEDIUM 50

In the module "Product Tag Icons Pro" (ticons) before 1.8.4 from MyPresta.eu for PrestaShop, a guest can perform SQL injection.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00766 Published 2023-12-06 No fix listed CWE-89

TI-2023-24341 CVE-2023-45386 · GHSA-4xch-3w57-6pj7

In the module extratabspro before version 2.2.8 from MyPresta.eu for PrestaShop, a guest…

HIGH 82

In the module extratabspro before version 2.2.8 from MyPresta.eu for PrestaShop, a guest can perform SQL injection via `extratabspro::searchcategory()`, `extratabspro::searchproduct()` and `extratabspro::searchmanufactur…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0077 Published 2023-10-17 No fix listed CWE-89

TI-2021-17745 CVE-2021-40814 · GHSA-fcm2-h2g5-2hxc

The Customer Photo Gallery addon before 2.9.4 for PrestaShop is vulnerable to SQL injection.

MEDIUM 44

The Customer Photo Gallery addon before 2.9.4 for PrestaShop is vulnerable to SQL injection.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0107 Published 2021-09-08 No fix listed CWE-89

TI-2018-13715 CVE-2018-19355 · GHSA-6fw6-r688-qw8v

modules/orderfiles/ajax/upload.php in the Customer Files Upload addon 2018-08-01 for…

MEDIUM 48

modules/orderfiles/ajax/upload.php in the Customer Files Upload addon 2018-08-01 for PrestaShop (1.5 through 1.7) allows remote attackers to execute arbitrary code by uploading a php file via modules/orderfiles/upload.ph…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03496 Published 2018-11-19 No fix listed CWE-434

Vulnerabilities

Filters

Unauthenticated arbitrary file write leading to RCE in gmfeed PrestaShop module

In the module mib < 1.6.1 from MyPresta.eu for PrestaShop, a guest can perform SQL…

In the module "Product Tag Icons Pro" (ticons) before 1.8.4 from MyPresta.eu for…

In the module extratabspro before version 2.2.8 from MyPresta.eu for PrestaShop, a guest…

The Customer Photo Gallery addon before 2.9.4 for PrestaShop is vulnerable to SQL injection.

modules/orderfiles/ajax/upload.php in the Customer Files Upload addon 2018-08-01 for…