Security
فارسی
All products

prestashop/prestashop

Composer · Package
31 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Anonymous PrestaShop customer can download other customers' invoicesCVE-2024-34717 · GHSA-7PJR-2RGH-FC5G prestashop/prestashop Composer Medium Fix reported
PrestaShop cross-site scripting via customer contact form in FO, through file uploadCVE-2024-34716 · GHSA-45VM-3J38-7P78 prestashop/prestashop Composer Critical Fix reported
PrestaShop XSS can be stored in DB from "add a message form" in order detail page (FO)CVE-2024-21628 · GHSA-VR7M-R9VM-M4WF prestashop/prestashop Composer Medium Fix reported
PrestaShop file deletion via attachment APICVE-2023-39529 · GHSA-2RF5-3FW8-QM47 prestashop/prestashop Composer Medium Fix reported
PrestaShop some attribute not escaped in Validate::isCleanHTML methodCVE-2024-21627 · GHSA-XGPM-Q3MQ-46RQ prestashop/prestashop Composer High Fix reported
PrestaShop path traversalCVE-2023-39525 · GHSA-M9R4-3FG7-PQM2 prestashop/prestashop Composer Medium Fix reported
SQL filter bypass leading to arbitrary write requests using "SQL Manager"CVE-2023-30839 · GHSA-P379-CXQH-Q822 prestashop/prestashop Composer Critical Fix reported
Path disclosure in JavaScript variableCVE-2024-26129 · GHSA-3366-9287-7QPR prestashop/prestashop Composer Medium Fix reported
PrestaShop file deletion via CustomerMessageCVE-2023-39530 · GHSA-V4GR-V679-42P7 prestashop/prestashop Composer Medium Fix reported
PrestaShop allows users to uninstall modules from backoffice, even with low rightsCVE-2023-43663 · GHSA-6JMF-2PFC-Q9M7 prestashop/prestashop Composer Medium Fix reported
PrestaShop boolean SQL injectionCVE-2023-39524 · GHSA-75P5-JWX4-QW9H prestashop/prestashop Composer Medium Fix reported
Possible CSRF token fixationCVE-2023-25170 · GHSA-3G43-X7QR-96PH prestashop/prestashop Composer Medium Fix reported
PrestaShop: Improper Use of Validation FrameworkCVE-2026-33674 · GHSA-283W-XF3Q-788V prestashop/prestashop Composer Low Fix reported
Presta Shop vulnerable to email enumeration CVE-2025-51586 · GHSA-8XX5-H6M3-JR33 prestashop/prestashop Composer Medium Fix reported
PrestaShop has a stored XSS executable in customer service viewCVE-2026-44212 · GHSA-W9F3-QC75-QGX9 prestashop/prestashop Composer Critical Fix reported
PrestaShop has multiple stored XSS vulnerabilities via unprotected Template variablesCVE-2026-33673 · GHSA-35PF-37C6-JXJV prestashop/prestashop Composer High Fix reported
PrestaShop affected by time based enumeration in FO login formCVE-2026-25597 · GHSA-67V7-3G49-MXH2 prestashop/prestashop Composer Medium Fix reported
PrestaShop XSS injection through Validate::isCleanHTML methodCVE-2023-39527 · GHSA-XW2R-F8XV-C8XP prestashop/prestashop Composer High Fix reported
PrestaShop allows employee without any access rights to list all installed modulesCVE-2023-43664 · GHSA-GVRG-62JP-RF7J prestashop/prestashop Composer Medium Fix reported
Arbitrary file read via SQL injectionCVE-2023-30545 · GHSA-8R4M-5P6P-52RP prestashop/prestashop Composer High Fix reported