PrestaShop vulnerabilities
Filtered catalog for this technology stack. Use KEV and EPSS sorting to prioritize — then open each CVE for remediation and version matching.
41 matching records
- UnknownExternal Control of File Name or PathPatch nowKEVEPSS 0.99%Sep 29, 2026
- Medium4.3Improper access control on the back-office notifications endpoint exposes customer dataOpen the advisoryAug 18, 2026
- Medium6.5SQL injection through back-office list filtersOpen the advisoryAug 18, 2026
- High7.3Client IP address can be spoofed through the X-Forwarded-For headerOpen the advisoryAug 18, 2026
- High8.0Formula injection in CSV exports (CSV injection)Open the advisoryAug 18, 2026
- High8.2Server-Side Request Forgery through image URLs in the CSV importOpen the advisoryAug 18, 2026
- High7.5An issue in prestashop upsshipping all versions through at least 2.4.0 allows a remote attacker to obtain sensitive information via the /modules/upsshipping/logs/, and…Check if you run itEPSS 0.31%May 18, 2026
- Critical9.3PrestaShop is an open source e-commerce web application.Check if you run itEPSS 0.43%May 4, 2026
- High7.6PrestaShop is an open source e-commerce web application.Check if you run itEPSS 0.27%Mar 23, 2026
- Medium5.3PrestaShop is an open source e-commerce web application.Check if you run itEPSS 0.25%Mar 23, 2026
- Medium5.3Time based enumeration in FO login formCheck if you run itEPSS 0.32%Feb 3, 2026
- Low3.8PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal.Check if you run itEPSS 0.27%Oct 16, 2025
- Medium4.1PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal.Check if you run itEPSS 0.92%Oct 16, 2025
- Critical9.1PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal.Check if you run itEPSS 0.50%Oct 16, 2025
- Medium4.2Email enumerationCheck if you run itEPSS 0.82%Sep 4, 2025
- Medium6.5A PHAR deserialization vulnerability in the component /themes/import of PrestaShop v8.2.0 allows attackers to execute arbitrary code via a crafted POST request.Check if you run itEPSS 0.93%Jul 30, 2025
- Unknownprestashop poststaticfooter Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')Patch nowKEVEPSS 32.41%Jul 21, 2025
- Unknownleotheme leocustomajax Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')Patch nowKEVEPSS 3.85%Jun 8, 2025
- Unknownapollotheme ap_pagebuilder Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')Patch nowKEVEPSS 13.65%Aug 6, 2024
- Unknownattribute_wizard_project attribute_wizard Unrestricted Upload of File with Dangerous TypePatch nowKEVEPSS 12.33%Jun 28, 2024
- UnknownPromokit.eu PrestaShop pkfacebook SQL InjectionPatch nowKEVEPSS 10.09%Jun 24, 2024
- Unknownjoommasters jms_blog Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')Patch nowKEVEPSS 58.74%Jun 22, 2024
- Unknownndkdesign ndk_steppingpack Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')Patch nowKEVEPSS 50.30%Jun 19, 2024
- Critical9.6XSS via customer contact form in FO, through file uploadCheck this weekEPSS 56.45%May 14, 2024
- Medium5.3Anonymous customer can download other customers's invoicesCheck if you run itEPSS 0.53%May 14, 2024