PR
Product
Prestashop
101
CVEs
0
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 25High 14Medium 51Low 1
Watch
Add Prestashop to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-84186 | 6.9 | Sep 7 | Incorrect access control in PrestaShop Affected: before 9.1.5; before 8.2.8 |
| CVE-2024-33272 | 6.8 | Apr 29 | SQL injection vulnerability in KnowBand for PrestaShop autosuggest before 2.0.0 allows an attacker to run arbitrary SQL commands via the… Affected: before 2.0.0 |
| CVE-2025-25692 | 6.5 | Jul 30 | A PHAR deserialization vulnerability in the _getHeaders function of PrestaShop v8.2.0 allows attackers to execute arbitrary code via a crafted POST request Affected: 8.2.0 |
| CVE-2025-25691 | 6.5 | Jul 30 | A PHAR deserialization vulnerability in the component /themes/import of PrestaShop v8.2.0 allows attackers to execute arbitrary code via a crafted POST request Affected: 8.2.0 |
| CVE-2023-30545 | 6.5 | Apr 25 | PrestaShop arbitrary file read vulnerability Affected: < 1.7.8.9; >= 8.0.0, < 8.0.4 |
| CVE-2020-5287 | 6.5 | Apr 20 | Improper access control on customers search in PrestaShop Affected: > 1.5.5.0, < 1.7.6.5 |
| CVE-2020-5288 | 6.5 | Apr 20 | Improper access control on product attributes page in PrestaShop Affected: >= 1.7.0.0, < 1.7.6.5 |
| CVE-2020-5293 | 6.5 | Apr 20 | Improper access control on product page with combinations, attachments and specific prices in PrestaShop Affected: >= 1.7.0.0, < 1.7.6.5 |
| CVE-2020-5279 | 6.5 | Apr 20 | Improper Access Control for certain legacy controller in PrestaShop Affected: >= 1.5.0.0, < 1.7.6.5 |
| CVE-2020-5250 | 6.3 | Mar 5 | Possible information disclosure in PrestaShop Affected: < 1.7.6.4 |
| CVE-2024-34716 | 6.1 | May 14 | PrestaShop vulnerable to XSS via customer contact form in FO, through file upload Affected: >= 8.1.0, < 8.1.6 |
| CVE-2024-21628 | 6.1 | Jan 2 | XSS can be stored in DB from "add a message form" in order detail page (FO) Affected: < 8.1.3 |
| CVE-2024-21627 | 6.1 | Jan 2 | Some attribute not escaped in Validate::isCleanHTML method Affected: >= 8.0.0, < 8.1.3; < 1.7.8.11 |
| CVE-2023-39527 | 6.1 | Aug 7 | PrestaShop XSS vulnerability through Validate::isCleanHTML method Affected: < 1.7.8.10; >= 8.0.0, < 8.0.5; = 8.1.0 |
| CVE-2012-20001 | 6.1 | Dec 21 | PrestaShop before 1.5.2 allows XSS via the "<object data='data:text/html" substring in the message field Affected: before 1.5.2 |
| CVE-2020-15161 | 6.1 | Sep 24 | Potential XSS in PrestaShop Affected: > 1.6.0.4, < 1.7.6.8 |
| CVE-2020-15083 | 6.1 | Jul 2 | Reflected XSS when uploading an image in the Product page in PrestaShop Affected: >= 1.7.0.0, < 1.7.6.6 |
| CVE-2020-5286 | 6.1 | Apr 20 | Reflected XSS related in import page in PrestaShop Affected: >= 1.7.4.0, < 1.7.6.5 |
| CVE-2020-5271 | 6.1 | Apr 20 | Reflected XSS with dashboard calendar of PrestaShop Affected: >= 1.6.0.0, < 1.7.6.5 |
| CVE-2020-5272 | 6.1 | Apr 20 | Reflected XSS on Search page of PrestaShop Affected: >= 1.5.5.0, < 1.7.6.5 |
| CVE-2020-5276 | 6.1 | Apr 20 | Reflected XSS on AdminCarts page of PrestaShop Affected: >= 1.7.1.0, < 1.7.6.5 |
| CVE-2020-5278 | 6.1 | Apr 20 | Reflected XSS on Exception page of PrestaShop Affected: >= 1.5.4.0, < 1.7.6.5 |
| CVE-2020-5285 | 6.1 | Apr 20 | Reflected XSS with back parameter in PrestaShop Affected: >= 1.7.6.0, < 1.7.6.5 |
| CVE-2020-5269 | 6.1 | Apr 20 | Reflected XSS on AdminFeatures page of PrestaShop Affected: >= 1.7.6.1, < 1.7.6.5 |
| CVE-2020-5270 | 6.1 | Apr 20 | Open redirection when using back parameter of PrestaShop Affected: >= 1.7.6.0, < 1.7.6.5 |
| CVE-2020-5264 | 6.1 | Apr 20 | Reflected XSS in security compromised page of PrestaShop Affected: < 1.7.6.5 |
| CVE-2020-5265 | 6.1 | Apr 20 | Reflected XSS on AdminAttributesGroups page of PrestaShop Affected: >= 1.7.6.1, < 1.7.6.5 |
| CVE-2012-2517 | 6.1 | Feb 11 | Cross-site scripting (XSS) vulnerability in PrestaShop before 1.4.9 allows remote attackers to inject arbitrary web script or HTML via the index of the product[] parameter to… Affected: before 1.4.9.0 |
| CVE-2020-6632 | 6.1 | Jan 9 | In PrestaShop 1.7.6.2, XSS can occur during addition or removal of a QuickAccess link Affected: 1.7.6.2 |
| CVE-2019-11876 | 6.1 | May 24 | In PrestaShop 1.7.5.2, the shop_country parameter in the install/index.php installation script/component is affected by Reflected XSS Affected: 1.7.5.2 |
| CVE-2013-4792 | 5.5 | Feb 13 | PrestaShop before 1.4.11 allows logout CSRF Affected: before 1.4.11 |
| CVE-2026-33673 | 5.4 | Mar 26 | PrestaShop has multiple stored XSS vulnerabilities via unprotected Template variables Affected: >= 9.0.0-alpha.1, < 9.1.0; < 8.2.5 |
| CVE-2021-21398 | 5.4 | Mar 30 | Possible XSS injection through DataColumn Grid class Affected: >= 1.7.7.0, < 1.7.7.3 |
| CVE-2020-15162 | 5.4 | Sep 24 | Stored XSS in PrestaShop Affected: > 1.5.0.0, < 1.7.6.8 |
| CVE-2020-11074 | 5.4 | Jul 2 | Stored XSS in PrestaShop Affected: >= 1.5.3.0, < 1.7.6.6 |
| CVE-2020-15079 | 5.4 | Jul 2 | Improper access control in PrestaShop Affected: >= 1.5.0.0, < 1.7.6.6 |
| CVE-2013-4791 | 5.4 | Feb 13 | PrestaShop before 1.4.11 allows Logistician, translators and other low level profiles/accounts to inject a persistent XSS vector on TinyMCE Affected: before 1.4.11 |
| CVE-2018-5681 | 5.4 | Jan 13 | PrestaShop 1.7.2.4 has XSS via source-code editing on the "Pages > Edit page" screen Affected: 1.7.2.4 |
| CVE-2026-33674 | 5.3 | Mar 26 | PrestaShop: Improper Use of Validation Framework Affected: < 8.2.5; >= 9.0.0-alpha.1, < 9.1.0 |
| CVE-2026-25597 | 5.3 | Feb 6 | PrestaShop has a time based enumeration in FO login form Affected: < 8.2.4; >= 9.0.0-alpha.1, < 9.0.3 |
| CVE-2024-36626 | 5.3 | Nov 29 | In prestashop 8.1.4, a NULL pointer dereference was identified in the math_round function within Tools.php Affected: 8.1.4 |
| CVE-2024-34717 | 5.3 | May 14 | Anonymous PrestaShop customer can download other customers' invoices Affected: = 8.1.5 |
| CVE-2024-26129 | 5.3 | Feb 19 | Prestashop vulnerable to path disclosure in JavaScript variable Affected: >= 8.1.0, < 8.1.4 |
| CVE-2020-15080 | 5.3 | Jul 2 | Information disclosure in release archive in PrestaShop Affected: >= 1.7.4.0, <1.7.6.6 |
| CVE-2020-15081 | 5.3 | Jul 2 | Information exposure in the upload directory in PrestaShop Affected: >= 1.5.0.0, < 1.7.6.6 |
| CVE-2018-5682 | 5.3 | Jan 13 | PrestaShop 1.7.2.4 allows user enumeration via the Reset Password feature, by noticing which reset attempts do not produce a "This account does not exist" error message Affected: 1.7.2.4 |
| CVE-2025-1230 | 4.8 | Feb 12 | Cross-Site Scripting (XSS) vulnerability in Prestashop Affected: 8.1.7 |
| CVE-2020-21967 | 4.8 | Jul 13 | File upload vulnerability in the Catalog feature in Prestashop 1.7.6.7 allows remote attackers to run arbitrary code via the add new file page Affected: 1.7.6.7 |
| CVE-2023-43664 | 4.3 | Sep 28 | Employee without any access rights can list all installed modules in Prestashop Affected: < 8.1.2 |
| CVE-2023-43663 | 4.3 | Sep 28 | Improper Privilege Management in Prestashop Affected: < 8.1.2 |