PrestaShop vulnerabilities
Filtered catalog for this technology stack. Use KEV and EPSS sorting to prioritize — then open each CVE for remediation and version matching.
41 matching records
- Medium5.8Path disclosure in JavaScript variableCheck if you run itEPSS 0.61%Feb 19, 2024
- Medium5.4XSS can be stored in DB from "add a message form" in order detail page (FO)Check if you run itEPSS 0.39%Jan 2, 2024
- High8.1Some attribute not escaped in Validate::isCleanHTML methodCheck if you run itEPSS 0.52%Jan 2, 2024
- Medium6.7Uninstall modules from backoffice, even with low rightsCheck if you run itEPSS 0.42%Sep 28, 2023
- Critical9.1Reading a file through path traversalCheck if you run itEPSS 0.76%Aug 7, 2023
- High8.3New possible XSS injection through Validate::isCleanHTML methodCheck if you run itEPSS 0.51%Aug 7, 2023
- Medium6.5path traversal: file deletionCheck if you run itEPSS 0.86%Aug 7, 2023
- Medium6.7SQL injection possible in search product in BOCheck if you run itEPSS 0.66%Aug 7, 2023
- Unknowntshirtecommerce custom_product_designer Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Patch nowKEVEPSS 3.57%Jun 1, 2023
- Unknowntshirtecommerce custom_product_designer Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Patch nowKEVEPSS 3.55%Jun 1, 2023
- Critical9.8idnovate popup_module_\(on_entering\,_exit_popup\,_add_product\)_and_newsletter Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')Patch nowKEVEPSS 3.02%Apr 12, 2023
- Unknowntshirtecommerce custom_product_designer Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')Patch nowKEVEPSS 3.30%Mar 21, 2023
- Unknowntshirtecommerce custom_product_designer Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')Patch nowKEVEPSS 3.30%Mar 21, 2023
- Critical9.8PrestaShop dpdfrance <6.1.3 is vulnerable to SQL Injection via dpdfrance/ajax.php.Check if you run itEPSS 0.89%Mar 13, 2023
- Unknownprestashop prestashop Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')Patch nowKEVEPSS 6.72%Jul 22, 2022
- Critical9.8smartdatasoft smartblog Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')Patch nowKEVEPSS 74.49%Aug 24, 2021