{"kind": "product", "path": "vulns/packagist/prestashop%2Fprestashop", "name": "prestashop/prestashop", "product": "prestashop/prestashop", "ecosystem": "Packagist", "items": [{"id": "CVE-2026-44212", "noindex": false, "published": "2026-05-14T20:44:08.152Z", "modified": "2026-05-15T13:34:09.904Z", "cvss": 9.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N", "severity": "critical", "epss": 0.00425, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-44212", "title": "PrestaShop: Stored XSS executable in customer service view", "description": "PrestaShop is an open source e-commerce web application. Prior to 8.2.6 and 9.1.1, there is a stored Cross-Site Scripting (XSS) vulnerability in the PrestaShop back-office Customer Service view. An unauthenticated attacker can submit the public Contact Us form with a malicious email address. The payload is stored in the database and executed when a back-office employee opens the affected customer thread, enabling session hijacking and full back-office takeover. This vulnerability is fixed in 8.2.6 and 9.1.1.", "references": ["https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-w9f3-qc75-qgx9", "https://nvd.nist.gov/vuln/detail/CVE-2026-44212"], "fixes": ["8.2.6", "9.1.1"], "products": [{"name": "prestashop/prestashop", "path": "vulns/packagist/prestashop%2Fprestashop", "ecosystem": "Packagist"}, {"name": "prestashop/prestashop", "path": "vulns/packagist/prestashop%2Fprestashop", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-33674", "noindex": false, "published": "2026-03-26T21:42:33.590Z", "modified": "2026-03-30T11:44:22.497Z", "cvss": 2, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N", "severity": "low", "epss": 0.00246, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-33674", "title": "PrestaShop: Improper Use of Validation Framework", "description": "PrestaShop is an open source e-commerce web application. Versions prior to 8.2.5 and 9.1.0 improperly use the validation framework. Versions 8.2.5 and 9.1.0 contain a fix. No known workarounds are available.", "references": ["https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-283w-xf3q-788v", "https://github.com/PrestaShop/PrestaShop/releases/tag/8.2.5", "https://github.com/PrestaShop/PrestaShop/releases/tag/9.1.0"], "fixes": ["8.2.5", "9.1.0"], "products": [{"name": "prestashop/prestashop", "path": "vulns/packagist/prestashop%2Fprestashop", "ecosystem": "Packagist"}, {"name": "prestashop/prestashop", "path": "vulns/packagist/prestashop%2Fprestashop", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-33673", "noindex": false, "published": "2026-03-26T21:41:13.249Z", "modified": "2026-03-27T20:27:40.683Z", "cvss": 7.7, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H", "severity": "high", "epss": 0.00275, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-33673", "title": "PrestaShop has multiple stored XSS vulnerabilities via unprotected Template variables", "description": "PrestaShop is an open source e-commerce web application. Versions prior to 8.2.5 and 9.1.0 are vulnerable to stored Cross-Site Scripting (stored XSS) vulnerabilities in the BO. An attacker who can inject data into the database, via limited back-office access or a previously existing vulnerability, can exploit unprotected variables in back-office templates. Versions 8.2.5 and 9.1.0 contain a fix. No known workarounds are available.", "references": ["https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-35pf-37c6-jxjv", "https://github.com/PrestaShop/PrestaShop/releases/tag/8.2.5", "https://github.com/PrestaShop/PrestaShop/releases/tag/9.1.0"], "fixes": ["8.2.5", "9.1.0"], "products": [{"name": "prestashop/prestashop", "path": "vulns/packagist/prestashop%2Fprestashop", "ecosystem": "Packagist"}, {"name": "prestashop/prestashop", "path": "vulns/packagist/prestashop%2Fprestashop", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-25597", "noindex": false, "published": "2026-02-06T20:47:24.793Z", "modified": "2026-02-09T15:27:54.047Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "severity": "medium", "epss": 0.00316, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-25597", "title": "PrestaShop has a time based enumeration in FO login form", "description": "PrestaShop is an open source e-commerce web application. Prior to 8.2.4 and 9.0.3, there is a time-based user enumeration vulnerability in the user authentication functionality of PrestaShop. This vulnerability allows an attacker to determine whether a customer account exists in the system by measuring response times. This vulnerability is fixed in 8.2.4 and 9.0.3.", "references": ["https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-67v7-3g49-mxh2", "https://github.com/PrestaShop/PrestaShop/releases/tag/8.2.4", "https://github.com/PrestaShop/PrestaShop/releases/tag/9.0.3"], "fixes": ["8.2.4", "9.0.3"], "products": [{"name": "prestashop/prestashop", "path": "vulns/packagist/prestashop%2Fprestashop", "ecosystem": "Packagist"}, {"name": "prestashop/prestashop", "path": "vulns/packagist/prestashop%2Fprestashop", "ecosystem": "Packagist"}]}, {"id": "CVE-2025-51586", "noindex": false, "published": "2025-09-08T00:00:00.000Z", "modified": "2025-09-08T17:50:16.864Z", "cvss": 3.7, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "severity": "low", "epss": 0.00816, "kev": false, "exploits": ["nuclei"], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2025-51586", "title": "CVE-2025-51586", "description": "An issue was discoverd in file controllers/admin/AdminLoginController.php in PrestaShop before 8.2.1 allowing attackers to gain sensitive information via the reset password feature.", "references": ["https://prestashop.com/", "https://github.com/PrestaShop/PrestaShop/releases/tag/8.2.1", "https://maxime-morel.github.io/advisories/2025/CVE-2025-51586.md"], "fixes": ["8.2.3"], "products": [{"name": "prestashop/prestashop", "path": "vulns/packagist/prestashop%2Fprestashop", "ecosystem": "Packagist"}]}, {"id": "CVE-2024-34717", "noindex": false, "published": "2024-05-14T15:47:27.265Z", "modified": "2024-08-02T02:59:22.270Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "severity": "medium", "epss": 0.00525, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2024-34717", "title": "Anonymous PrestaShop customer can download other customers' invoices", "description": "PrestaShop is an open source e-commerce web application. In PrestaShop 8.1.5, any invoice can be downloaded from front-office in anonymous mode, by supplying a random secure_key parameter in the url. This issue is patched in version 8.1.6. No known workarounds are available.", "references": ["https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-7pjr-2rgh-fc5g", "https://github.com/PrestaShop/PrestaShop/releases/tag/8.1.6", "https://nvd.nist.gov/vuln/detail/CVE-2024-34717"], "fixes": ["8.1.6"], "products": [{"name": "prestashop/prestashop", "path": "vulns/packagist/prestashop%2Fprestashop", "ecosystem": "Packagist"}]}, {"id": "CVE-2024-34716", "noindex": false, "published": "2024-05-14T15:45:45.345Z", "modified": "2024-08-02T02:59:22.218Z", "cvss": 9.7, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "severity": "critical", "epss": 0.56445, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2024-34716", "title": "PrestaShop vulnerable to XSS via customer contact form in FO, through file upload", "description": "PrestaShop is an open source e-commerce web application. A cross-site scripting (XSS) vulnerability that only affects PrestaShops with customer-thread feature flag enabled is present starting from PrestaShop 8.1.0 and prior to PrestaShop 8.1.6. When the customer thread feature flag is enabled through the front-office contact form, a hacker can upload a malicious file containing an XSS that will be executed when an admin opens the attached file in back office. The script injected can access the session and the security token, which allows it to perform any authenticated action in the scope of the administrator's right. This vulnerability is pa", "references": ["https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-45vm-3j38-7p78", "https://github.com/PrestaShop/PrestaShop/releases/tag/8.1.6", "https://nvd.nist.gov/vuln/detail/CVE-2024-34716"], "fixes": ["8.1.6"], "products": [{"name": "prestashop/prestashop", "path": "vulns/packagist/prestashop%2Fprestashop", "ecosystem": "Packagist"}]}, {"id": "CVE-2024-26129", "noindex": false, "published": "2024-02-19T21:59:54.426Z", "modified": "2024-08-01T23:59:32.697Z", "cvss": 5.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N", "severity": "medium", "epss": 0.0061, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2024-26129", "title": "Prestashop vulnerable to path disclosure in JavaScript variable", "description": "PrestaShop is an open-source e-commerce platform. Starting in version 8.1.0 and prior to version 8.1.4, PrestaShop is vulnerable to path disclosure in a JavaScript variable. A patch is available in version 8.1.4.", "references": ["https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-3366-9287-7qpr", "https://github.com/PrestaShop/PrestaShop/commit/444bd0dea581659918fe2067541b9863cf099dd5", "https://owasp.org/www-community/attacks/Full_Path_Disclosure"], "fixes": ["8.1.4"], "products": [{"name": "prestashop/prestashop", "path": "vulns/packagist/prestashop%2Fprestashop", "ecosystem": "Packagist"}]}, {"id": "CVE-2024-21628", "noindex": false, "published": "2024-01-02T21:17:14.733Z", "modified": "2024-11-14T19:10:16.008Z", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:L", "severity": "medium", "epss": 0.00389, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2024-21628", "title": "XSS can be stored in DB from \"add a message form\" in order detail page (FO)", "description": "PrestaShop is an open-source e-commerce platform. Prior to version 8.1.3, the isCleanHtml method is not used on this this form, which makes it possible to store a cross-site scripting payload in the database. The impact is low because the HTML is not interpreted in BO, thanks to twig's escape mechanism. In FO, the cross-site scripting attack is effective, but only impacts the customer sending it, or the customer session from which it was sent. This issue affects those who have a module fetching these messages from the DB and displaying it without escaping HTML. Version 8.1.3 contains a patch for this issue.", "references": ["https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-vr7m-r9vm-m4wf", "https://github.com/PrestaShop/PrestaShop/commit/c3d78b7e49f5fe49a9d07725c3174d005deaa597", "https://nvd.nist.gov/vuln/detail/CVE-2024-21628"], "fixes": ["8.1.3"], "products": [{"name": "prestashop/prestashop", "path": "vulns/packagist/prestashop%2Fprestashop", "ecosystem": "Packagist"}]}, {"id": "CVE-2024-21627", "noindex": false, "published": "2024-01-02T21:03:17.816Z", "modified": "2025-06-03T14:45:21.732Z", "cvss": 8.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N", "severity": "high", "epss": 0.00523, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2024-21627", "title": "Some attribute not escaped in Validate::isCleanHTML method", "description": "PrestaShop is an open-source e-commerce platform. Prior to versions 8.1.3 and 1.7.8.11, some event attributes are not detected by the `isCleanHTML` method. Some modules using the `isCleanHTML` method could be vulnerable to cross-site scripting. Versions 8.1.3 and 1.7.8.11 contain a patch for this issue. The best workaround is to use the `HTMLPurifier` library to sanitize html input coming from users. The library is already available as a dependency in the PrestaShop project. Beware though that in legacy object models, fields of `HTML` type will call `isCleanHTML`.", "references": ["https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-xgpm-q3mq-46rq", "https://github.com/PrestaShop/PrestaShop/commit/73cfb44666818eefd501b526a894fe884dd12129", "https://github.com/PrestaShop/PrestaShop/commit/ba06d18466df5b92cb841d504cc7210121104883"], "fixes": ["1.7.8.11", "8.1.3"], "products": [{"name": "prestashop/prestashop", "path": "vulns/packagist/prestashop%2Fprestashop", "ecosystem": "Packagist"}, {"name": "prestashop/prestashop", "path": "vulns/packagist/prestashop%2Fprestashop", "ecosystem": "Packagist"}]}, {"id": "CVE-2023-43664", "noindex": false, "published": "2023-09-28T18:16:57.658Z", "modified": "2024-09-20T19:26:46.506Z", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "severity": "medium", "epss": 0.00483, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2023-43664", "title": "Employee without any access rights can list all installed modules in Prestashop", "description": "PrestaShop is an Open Source e-commerce web application. In the Prestashop Back office interface, an employee can list all modules without any access rights: method `ajaxProcessGetPossibleHookingListForModule` doesn't check access rights. This issue has been addressed in commit `15bd281c` which is included in version 8.1.2. Users are advised to upgrade. There are no known workaround for this issue.", "references": ["https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-gvrg-62jp-rf7j", "https://github.com/PrestaShop/PrestaShop/commit/15bd281c18f032a5134a8d213b44d24829d45762", "https://nvd.nist.gov/vuln/detail/CVE-2023-43664"], "fixes": ["8.1.2"], "products": [{"name": "prestashop/prestashop", "path": "vulns/packagist/prestashop%2Fprestashop", "ecosystem": "Packagist"}]}, {"id": "CVE-2023-43663", "noindex": false, "published": "2023-09-28T18:13:49.216Z", "modified": "2024-09-20T19:32:29.398Z", "cvss": 6.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "severity": "medium", "epss": 0.00416, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2023-43663", "title": "Improper Privilege Management in Prestashop", "description": "PrestaShop is an Open Source e-commerce web application. In affected versions any module can be disabled or uninstalled from back office, even with low user right. This allows low privileged users to disable portions of a shops functionality. Commit `ce1f6708` addresses this issue and is included in version 8.1.2. Users are advised to upgrade. There are no known workarounds for this issue.", "references": ["https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-6jmf-2pfc-q9m7", "https://github.com/PrestaShop/PrestaShop/commit/ce1f67083537194e974caf86c57e547a0aaa46cd", "https://nvd.nist.gov/vuln/detail/CVE-2023-43663"], "fixes": ["8.1.2"], "products": [{"name": "prestashop/prestashop", "path": "vulns/packagist/prestashop%2Fprestashop", "ecosystem": "Packagist"}]}, {"id": "CVE-2023-39530", "noindex": false, "published": "2023-08-07T20:51:52.155Z", "modified": "2024-10-08T17:34:13.109Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H", "severity": "medium", "epss": 0.00856, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2023-39530", "title": "PrestaShop vulnerable to file deletion via CustomerMessage", "description": "PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, it is possible to delete files from the server via the CustomerMessage API. Version 8.1.1 contains a patch for this issue. There are no known workarounds.", "references": ["https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-v4gr-v679-42p7", "https://github.com/PrestaShop/PrestaShop/commit/6ce750b2367a7309b6bf50166f1873cb86ad57e9", "https://nvd.nist.gov/vuln/detail/CVE-2023-39530"], "fixes": ["8.1.1"], "products": [{"name": "prestashop/prestashop", "path": "vulns/packagist/prestashop%2Fprestashop", "ecosystem": "Packagist"}]}, {"id": "CVE-2023-39529", "noindex": false, "published": "2023-08-07T20:37:15.946Z", "modified": "2024-10-03T16:10:35.680Z", "cvss": 6.7, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H", "severity": "medium", "epss": 0.00713, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2023-39529", "title": "PrestaShop vulnerable to file deletion via attachment API", "description": "PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, it is possible to delete a file from the server by using the Attachments controller and the Attachments API. Version 8.1.1 contains a patch for this issue. There are no known workarounds.", "references": ["https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-2rf5-3fw8-qm47", "https://github.com/PrestaShop/PrestaShop/commit/b08c647305dc1e9e6a2445b724d13a9733b6ed82", "https://nvd.nist.gov/vuln/detail/CVE-2023-39529"], "fixes": ["8.1.1"], "products": [{"name": "prestashop/prestashop", "path": "vulns/packagist/prestashop%2Fprestashop", "ecosystem": "Packagist"}]}, {"id": "CVE-2023-39528", "noindex": false, "published": "2023-08-07T20:35:07.663Z", "modified": "2024-10-03T16:13:39.365Z", "cvss": 6.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N", "severity": "medium", "epss": 0.00755, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2023-39528", "title": "PrestaShop vulnerable to file reading through path traversal", "description": "PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, the `displayAjaxEmailHTML` method can be used to read any file on the server, potentially even outside of the project if the server is not correctly configured. Version 8.1.1 contains a patch for this issue. There are no known workarounds.", "references": ["https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-hpf4-v7v2-95p2", "https://github.com/PrestaShop/PrestaShop/commit/11de3a84322fa4ecd0995ac40d575db61804724c", "https://nvd.nist.gov/vuln/detail/CVE-2023-39528"], "fixes": ["8.1.1"], "products": [{"name": "prestashop/prestashop", "path": "vulns/packagist/prestashop%2Fprestashop", "ecosystem": "Packagist"}]}, {"id": "CVE-2023-39527", "noindex": false, "published": "2023-08-07T20:32:45.203Z", "modified": "2024-10-03T16:15:18.378Z", "cvss": 8.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:H", "severity": "high", "epss": 0.00513, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2023-39527", "title": "PrestaShop XSS vulnerability through Validate::isCleanHTML method", "description": "PrestaShop is an open source e-commerce web application. Versions prior to 1.7.8.10, 8.0.5, and 8.1.1 are vulnerable to cross-site scripting through the `isCleanHTML` method. Versions 1.7.8.10, 8.0.5, and 8.1.1 contain a patch. There are no known workarounds.", "references": ["https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-xw2r-f8xv-c8xp", "https://github.com/PrestaShop/PrestaShop/commit/afc14f8eaa058b3e6a20ac43e033ee2656fb88b4", "https://nvd.nist.gov/vuln/detail/CVE-2023-39527"], "fixes": ["1.7.8.10", "8.0.5", "8.1.1"], "products": [{"name": "prestashop/prestashop", "path": "vulns/packagist/prestashop%2Fprestashop", "ecosystem": "Packagist"}, {"name": "prestashop/prestashop", "path": "vulns/packagist/prestashop%2Fprestashop", "ecosystem": "Packagist"}, {"name": "prestashop/prestashop", "path": "vulns/packagist/prestashop%2Fprestashop", "ecosystem": "Packagist"}]}, {"id": "CVE-2023-39526", "noindex": false, "published": "2023-08-07T20:28:59.051Z", "modified": "2024-10-10T19:06:10.065Z", "cvss": 9.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "severity": "critical", "epss": 0.01693, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2023-39526", "title": "PrestaShopSQL manager vulnerability (potential RCE)", "description": "PrestaShop is an open source e-commerce web application. Versions prior to 1.7.8.10, 8.0.5, and 8.1.1 are vulnerable to remote code execution through SQL injection and arbitrary file write in the back office. Versions 1.7.8.10, 8.0.5, and 8.1.1 contain a patch. There are no known workarounds.", "references": ["https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-gf46-prm4-56pc", "https://github.com/PrestaShop/PrestaShop/commit/817847e2347844a9b6add017581f1932bcd28c09", "https://nvd.nist.gov/vuln/detail/CVE-2023-39526"], "fixes": ["1.7.8.10", "8.0.5", "8.1.1"], "products": [{"name": "prestashop/prestashop", "path": "vulns/packagist/prestashop%2Fprestashop", "ecosystem": "Packagist"}, {"name": "prestashop/prestashop", "path": "vulns/packagist/prestashop%2Fprestashop", "ecosystem": "Packagist"}, {"name": "prestashop/prestashop", "path": "vulns/packagist/prestashop%2Fprestashop", "ecosystem": "Packagist"}]}, {"id": "CVE-2023-39525", "noindex": false, "published": "2023-08-07T20:23:53.884Z", "modified": "2024-10-03T16:20:05.542Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H", "severity": "medium", "epss": 0.00864, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2023-39525", "title": "PrestaShop vulnerable to path traversal", "description": "PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, in the back office, files can be compromised using path traversal by replaying the import file deletion query with a specified file path that uses the traversal path. Version 8.1.1 contains a patch for this issue. There are no known workarounds.", "references": ["https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-m9r4-3fg7-pqm2", "https://github.com/PrestaShop/PrestaShop/commit/c7c9a5110421bb2856f4d312ecce192d079b5ec7", "https://nvd.nist.gov/vuln/detail/CVE-2023-39525"], "fixes": ["8.1.1"], "products": [{"name": "prestashop/prestashop", "path": "vulns/packagist/prestashop%2Fprestashop", "ecosystem": "Packagist"}]}, {"id": "CVE-2023-39524", "noindex": false, "published": "2023-08-07T19:48:21.994Z", "modified": "2024-10-03T16:20:27.279Z", "cvss": 6.7, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H", "severity": "medium", "epss": 0.00657, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2023-39524", "title": "PrestaShop vulnerable to boolean SQL injection in search product in BO", "description": "PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, SQL injection possible in the product search field, in BO's product page. Version 8.1.1 contains a patch for this issue. There are no known workarounds.", "references": ["https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-75p5-jwx4-qw9h", "https://github.com/PrestaShop/PrestaShop/commit/2047d4c053043102bc46a37d383b392704bf14d7", "https://nvd.nist.gov/vuln/detail/CVE-2023-39524"], "fixes": ["8.1.1"], "products": [{"name": "prestashop/prestashop", "path": "vulns/packagist/prestashop%2Fprestashop", "ecosystem": "Packagist"}]}, {"id": "CVE-2023-30839", "noindex": false, "published": "2023-04-25T18:41:38.777Z", "modified": "2025-02-03T18:08:09.963Z", "cvss": 10, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "severity": "critical", "epss": 0.01706, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2023-30839", "title": "PrestaShop vulnerable to SQL filter bypass leading to arbitrary write requests using \"SQL Manager\"", "description": "PrestaShop is an Open Source e-commerce web application. Versions prior to 8.0.4 and 1.7.8.9 contain a SQL filtering vulnerability. A BO user can write, update, and delete in the database, even without having specific rights. PrestaShop 8.0.4 and 1.7.8.9 contain a patch for this issue. There are no known workarounds.", "references": ["https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-p379-cxqh-q822", "https://github.com/PrestaShop/PrestaShop/commit/0f2a9b7fdd42d1dd3b21d4fad586a849642f3c30", "https://github.com/PrestaShop/PrestaShop/commit/d1d27dc371599713c912b71bc2a455cacd7f2149"], "fixes": ["1.7.8.9", "8.0.4"], "products": [{"name": "prestashop/prestashop", "path": "vulns/packagist/prestashop%2Fprestashop", "ecosystem": "Packagist"}, {"name": "prestashop/prestashop", "path": "vulns/packagist/prestashop%2Fprestashop", "ecosystem": "Packagist"}]}], "total": 31, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 2, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "prestashop/prestashop", "path": "vulns/packagist/prestashop%2Fprestashop", "ecosystem": "Packagist"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": ["9.1.0-rc.1", "9.1.0-beta.1", "9.1.0", "9.0.3", "9.0.2", "9.0.1", "9.0.0-rc.1", "9.0.0-beta.1", "9.0.0-alpha.1", "9.0.0", "8.2.5", "8.2.4"], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-05-15T13:34:09.904Z", "early_advisories": [], "license": "Подборку PatchFirst и наши дополнения (приоритеты, ранние предупреждения, тексты, сводки и агрегаты) можно свободно использовать для собственных целей, включая внутренние задачи бизнеса. Перепродажа, коммерческое распространение и массовое зеркалирование этой подборки или дополнений допускаются только по письменному соглашению с оператором. При любом использовании или публикации подборки или наших дополнений указывайте PatchFirst (https://ru.patchfirst.dev/vulns/) с этой ссылкой на страницу ленты своего региона. Исходные записи открытых источников остаются под их лицензиями и условиями. Эти условия не ограничивают ваши права на исходные данные, которые можно получить у источников напрямую.", "terms_url": "https://ru.patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://ru.patchfirst.dev/vulns/"}, "source_changes": "PatchFirst отбирает, нормализует и объединяет записи; могут добавляться сводки и переводы. Новости указываются ссылкой на первоисточник в самой записи.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Лицензии исходных баз различаются; см. каталог источников."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Оценки доступны свободно; запрашивается указание источника (FIRST EPSS, оценки подготовлены Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}