PrestaShop Archives - Standoutmedia A/S

Multiple stored XSS via unprotected back-office template variables p6

Skrevet den 5. august 2026 af i PrestaShop

An attacker who can inject data into the database either through limited back-office access or by chaining an existing vulnerability such as SQL injection can exploit unescaped variables in back-office templates to execute arbitrary JavaScript within an authenticated administrator’s session.

The fix escapes HTML output across dozens of legacy Smarty (.tpl) and modern Twig (.html.twig) back-office templates, including group names, category paths, customer thread and message content, shop names, translation modules, and the admin login page. It also hardens the translation pipeline by introducing a dedicated HTMLPurifier-backed Twig extension (RawPurifiedExtension), wired through TranslationService and the Symfony service container.

This vulnerability affects the following application versions:

PrestaShop 1.6.0.1
PrestaShop 1.6.0.1 alpha 1
PrestaShop 1.6.0.2
PrestaShop 1.6.0.2 alpha 2
PrestaShop 1.6.0.3
PrestaShop 1.6.0.3 beta 1
PrestaShop 1.6.0.4
PrestaShop 1.6.0.4 RC1
PrestaShop 1.6.0.5
PrestaShop 1.6.0.6
PrestaShop 1.6.0.7
PrestaShop 1.6.0.8
PrestaShop 1.6.0.9
PrestaShop 1.6.0.10
PrestaShop 1.6.0.11
PrestaShop 1.6.0.12
PrestaShop 1.6.0.13
PrestaShop 1.6.0.14
PrestaShop 1.6.1.0
PrestaShop 1.6.1.0 RC4
PrestaShop 1.6.1.0 RC5
PrestaShop 1.6.1.1
PrestaShop 1.6.1.1 RC1
PrestaShop 1.6.1.1 RC2
PrestaShop 1.6.1.2
PrestaShop 1.6.1.2 RC1
PrestaShop 1.6.1.2 RC2
PrestaShop 1.6.1.2 RC3
PrestaShop 1.6.1.2 RC4
PrestaShop 1.6.1.3
PrestaShop 1.6.1.3 RC1
PrestaShop 1.6.1.4
PrestaShop 1.6.1.5
PrestaShop 1.6.1.6
PrestaShop 1.6.1.7
PrestaShop 1.6.1.8
PrestaShop 1.6.1.9
PrestaShop 1.6.1.10
PrestaShop 1.6.1.11
PrestaShop 1.6.1.11 beta 1
PrestaShop 1.6.1.11-beta.1.0
PrestaShop 1.6.1.12
PrestaShop 1.6.1.13
PrestaShop 1.6.1.14
PrestaShop 1.6.1.15
PrestaShop 1.6.1.16
PrestaShop 1.6.1.17
PrestaShop 1.6.1.18
PrestaShop 1.6.1.19
PrestaShop 1.6.1.20
PrestaShop 1.6.1.21
PrestaShop 1.6.1.22
PrestaShop 1.6.1.23
PrestaShop 1.6.1.24
PrestaShop 1.7.0.0
PrestaShop 1.7.0.0 alpha3
PrestaShop 1.7.0.0 alpha4
PrestaShop 1.7.0.0 beta1
PrestaShop 1.7.0.0 beta2
PrestaShop 1.7.0.0 beta3
PrestaShop 1.7.0.0 RC0
PrestaShop 1.7.0.0 RC1
PrestaShop 1.7.0.0 RC2
PrestaShop 1.7.0.0 RC3
PrestaShop 1.7.0.1
PrestaShop 1.7.0.2
PrestaShop 1.7.0.3
PrestaShop 1.7.0.4
PrestaShop 1.7.0.5
PrestaShop 1.7.0.6
PrestaShop 1.7.1.0
PrestaShop 1.7.1.0 beta1
PrestaShop 1.7.1.1
PrestaShop 1.7.1.2
PrestaShop 1.7.2.0
PrestaShop 1.7.2.0 RC 1
PrestaShop 1.7.2.0-RC.1.0
PrestaShop 1.7.2.1
PrestaShop 1.7.2.2
PrestaShop 1.7.2.3
PrestaShop 1.7.2.4
PrestaShop 1.7.2.5
PrestaShop 1.7.3.0
PrestaShop 1.7.3.0 beta 1
PrestaShop 1.7.3.0 RC 1
PrestaShop 1.7.3.1
PrestaShop 1.7.3.2
PrestaShop 1.7.3.3
PrestaShop 1.7.3.4
PrestaShop 1.7.4.0
PrestaShop 1.7.4.0 beta 1
PrestaShop 1.7.4.1
PrestaShop 1.7.4.2
PrestaShop 1.7.4.3
PrestaShop 1.7.4.4
PrestaShop 1.7.5.0
PrestaShop 1.7.5.0 beta 1
PrestaShop 1.7.5.0 RC 1
PrestaShop 1.7.5.0-beta.1
PrestaShop 1.7.5.0-RC.1
PrestaShop 1.7.5.1
PrestaShop 1.7.5.2
PrestaShop 1.7.6.0
PrestaShop 1.7.6.0 beta 1
PrestaShop 1.7.6.0 RC 1
PrestaShop 1.7.6.0 RC 2
PrestaShop 1.7.6.0-beta.1
PrestaShop 1.7.6.0-RC.1
PrestaShop 1.7.6.0-RC.2
PrestaShop 1.7.6.1
PrestaShop 1.7.6.2
PrestaShop 1.7.6.3
PrestaShop 1.7.6.4
PrestaShop 1.7.6.4 1
PrestaShop 1.7.6.5
PrestaShop 1.7.6.5 1
PrestaShop 1.7.6.6
PrestaShop 1.7.6.7
PrestaShop 1.7.6.8
PrestaShop 1.7.6.9
PrestaShop 1.7.7.0
PrestaShop 1.7.7.0 beta 1
PrestaShop 1.7.7.0 beta 2
PrestaShop 1.7.7.0 RC 1
PrestaShop 1.7.7.0-beta.1
PrestaShop 1.7.7.0-beta.2
PrestaShop 1.7.7.0-RC.1
PrestaShop 1.7.7.1
PrestaShop 1.7.7.2
PrestaShop 1.7.7.3
PrestaShop 1.7.7.4
PrestaShop 1.7.7.5
PrestaShop 1.7.7.6
PrestaShop 1.7.7.7
PrestaShop 1.7.7.8
PrestaShop 1.7.7.8 1
PrestaShop 1.7.8.0
PrestaShop 1.7.8.0 beta 1
PrestaShop 1.7.8.0 1
PrestaShop 1.7.8.0 RC 1
PrestaShop 1.7.8.0-beta.1
PrestaShop 1.7.8.0-RC.1
PrestaShop 1.7.8.1
PrestaShop 1.7.8.2
PrestaShop 1.7.8.2 1
PrestaShop 1.7.8.3
PrestaShop 1.7.8.4
PrestaShop 1.7.8.5
PrestaShop 1.7.8.6
PrestaShop 1.7.8.7
PrestaShop 1.7.8.7 1
PrestaShop 1.7.8.8
PrestaShop 1.7.8.9
PrestaShop 1.7.8.10
PrestaShop 1.7.8.11
PrestaShop 8.0.0
PrestaShop 8.0.1
PrestaShop 8.0.2
PrestaShop 8.0.3
PrestaShop 8.0.4
PrestaShop 8.0.5
PrestaShop 8.1.0
PrestaShop 8.1.1
PrestaShop 8.1.2
PrestaShop 8.1.3
PrestaShop 8.1.4
PrestaShop 8.1.5
PrestaShop 8.1.6
PrestaShop 8.1.7
PrestaShop 8.2.0
PrestaShop 8.2.1
PrestaShop 8.2.2
PrestaShop 8.2.3
PrestaShop 8.2.4

Time-based Username Enumeration in PrestaShop Customer Authentication

Skrevet den 7. juli 2026 af i PrestaShop

The Customer::getByEmail() method short-circuited and skipped password_verify() when the supplied email did not exist, making responses for non-existing accounts measurably faster. An unauthenticated remote attacker can use this timing oracle to enumerate valid customer email addresses for credential-stuffing, phishing, or password-spray attacks.

This vulnerability affects the following application versions:

PrestaShop 1.7.2.0
PrestaShop 1.7.2.0 RC 1
PrestaShop 1.7.2.0-RC.1.0
PrestaShop 1.7.2.1
PrestaShop 1.7.2.2
PrestaShop 1.7.2.3
PrestaShop 1.7.2.4
PrestaShop 1.7.2.5
PrestaShop 1.7.3.0
PrestaShop 1.7.3.0 beta 1
PrestaShop 1.7.3.0 RC 1
PrestaShop 1.7.3.1
PrestaShop 1.7.3.2
PrestaShop 1.7.3.3
PrestaShop 1.7.3.4
PrestaShop 1.7.4.0
PrestaShop 1.7.4.0 beta 1
PrestaShop 1.7.4.1
PrestaShop 1.7.4.2
PrestaShop 1.7.4.3
PrestaShop 1.7.4.4
PrestaShop 1.7.5.0
PrestaShop 1.7.5.0 beta 1
PrestaShop 1.7.5.0 RC 1
PrestaShop 1.7.5.0-beta.1
PrestaShop 1.7.5.0-RC.1
PrestaShop 1.7.5.1
PrestaShop 1.7.5.2
PrestaShop 1.7.6.0
PrestaShop 1.7.6.0 beta 1
PrestaShop 1.7.6.0 RC 1
PrestaShop 1.7.6.0 RC 2
PrestaShop 1.7.6.0-beta.1
PrestaShop 1.7.6.0-RC.1
PrestaShop 1.7.6.0-RC.2
PrestaShop 1.7.6.1
PrestaShop 1.7.6.2
PrestaShop 1.7.6.3
PrestaShop 1.7.6.4
PrestaShop 1.7.6.4 1
PrestaShop 1.7.6.5
PrestaShop 1.7.6.5 1
PrestaShop 1.7.6.6
PrestaShop 1.7.6.7
PrestaShop 1.7.6.8
PrestaShop 1.7.6.9
PrestaShop 1.7.7.0
PrestaShop 1.7.7.0 beta 1
PrestaShop 1.7.7.0 beta 2
PrestaShop 1.7.7.0 RC 1
PrestaShop 1.7.7.0-beta.1
PrestaShop 1.7.7.0-beta.2
PrestaShop 1.7.7.0-RC.1
PrestaShop 1.7.7.1
PrestaShop 1.7.7.2
PrestaShop 1.7.7.3
PrestaShop 1.7.7.4
PrestaShop 1.7.7.5
PrestaShop 1.7.7.6
PrestaShop 1.7.7.7
PrestaShop 1.7.7.8
PrestaShop 1.7.7.8 1
PrestaShop 1.7.8.0
PrestaShop 1.7.8.0 beta 1
PrestaShop 1.7.8.0 1
PrestaShop 1.7.8.0 RC 1
PrestaShop 1.7.8.0-beta.1
PrestaShop 1.7.8.0-RC.1
PrestaShop 1.7.8.1
PrestaShop 1.7.8.2
PrestaShop 1.7.8.2 1
PrestaShop 1.7.8.3
PrestaShop 1.7.8.4
PrestaShop 1.7.8.5
PrestaShop 1.7.8.6
PrestaShop 1.7.8.7
PrestaShop 1.7.8.7 1
PrestaShop 1.7.8.8
PrestaShop 1.7.8.9
PrestaShop 1.7.8.10
PrestaShop 1.7.8.11
PrestaShop 8.0.0
PrestaShop 8.0.1
PrestaShop 8.0.2
PrestaShop 8.0.3
PrestaShop 8.0.4
PrestaShop 8.0.5
PrestaShop 8.1.0
PrestaShop 8.1.1
PrestaShop 8.1.2
PrestaShop 8.1.3
PrestaShop 8.1.4
PrestaShop 8.1.5
PrestaShop 8.1.6
PrestaShop 8.1.7
PrestaShop 8.2.0
PrestaShop 8.2.1
PrestaShop 8.2.2
PrestaShop 8.2.3
PrestaShop 9.0.0
PrestaShop 9.0.0-1.0-RC.1
PrestaShop 9.0.1
PrestaShop 9.0.1-1.0
PrestaShop 9.0.2
PrestaShop 9.0.2-2.0
PrestaShop 9.1.0
PrestaShop 9.1.0-3.0-beta.1
PrestaShop 9.1.0-4.0
PrestaShop 9.1.0-4.0-RC.1
PrestaShop 9.1.1
PrestaShop 9.1.2
PrestaShop 9.1.3
PrestaShop 9.1.3-5.0
PrestaShop 9.1.4
PrestaShop 9.1.4-5.0

Multiple stored XSS via unprotected back-office template variables p2

Skrevet den 7. juli 2026 af i PrestaShop

This vulnerability affects the following application versions:

PrestaShop 1.5.6.0
PrestaShop 1.5.6.1
PrestaShop 1.5.6.2
PrestaShop 1.5.6.3
PrestaShop 1.6.0.1
PrestaShop 1.6.0.1 alpha 1
PrestaShop 1.6.0.2
PrestaShop 1.6.0.2 alpha 2
PrestaShop 1.6.0.3
PrestaShop 1.6.0.3 beta 1
PrestaShop 1.6.0.4
PrestaShop 1.6.0.4 RC1
PrestaShop 1.6.0.5
PrestaShop 1.6.0.6
PrestaShop 1.6.0.7
PrestaShop 1.6.0.8
PrestaShop 1.6.0.9
PrestaShop 1.6.0.10
PrestaShop 1.6.0.11
PrestaShop 1.6.0.12
PrestaShop 1.6.0.13
PrestaShop 1.6.0.14
PrestaShop 1.6.1.0
PrestaShop 1.6.1.0 RC4
PrestaShop 1.6.1.0 RC5
PrestaShop 1.6.1.1
PrestaShop 1.6.1.1 RC1
PrestaShop 1.6.1.1 RC2
PrestaShop 1.6.1.2
PrestaShop 1.6.1.2 RC1
PrestaShop 1.6.1.2 RC2
PrestaShop 1.6.1.2 RC3
PrestaShop 1.6.1.2 RC4
PrestaShop 1.6.1.3
PrestaShop 1.6.1.3 RC1
PrestaShop 1.6.1.4
PrestaShop 1.6.1.5
PrestaShop 1.6.1.6
PrestaShop 1.6.1.7
PrestaShop 1.6.1.8
PrestaShop 1.6.1.9
PrestaShop 1.6.1.10
PrestaShop 1.6.1.11
PrestaShop 1.6.1.11 beta 1
PrestaShop 1.6.1.11-beta.1.0
PrestaShop 1.6.1.12
PrestaShop 1.6.1.13
PrestaShop 1.6.1.14
PrestaShop 1.6.1.15
PrestaShop 1.6.1.16
PrestaShop 1.6.1.17
PrestaShop 1.6.1.18
PrestaShop 1.6.1.19
PrestaShop 1.6.1.20
PrestaShop 1.6.1.21
PrestaShop 1.6.1.22
PrestaShop 1.6.1.23
PrestaShop 1.6.1.24
PrestaShop 1.7.0.0
PrestaShop 1.7.0.0 alpha3
PrestaShop 1.7.0.0 alpha4
PrestaShop 1.7.0.0 beta1
PrestaShop 1.7.0.0 beta2
PrestaShop 1.7.0.0 beta3
PrestaShop 1.7.0.0 RC0
PrestaShop 1.7.0.0 RC1
PrestaShop 1.7.0.0 RC2
PrestaShop 1.7.0.0 RC3
PrestaShop 1.7.0.1
PrestaShop 1.7.0.2
PrestaShop 1.7.0.3
PrestaShop 1.7.0.4
PrestaShop 1.7.0.5
PrestaShop 1.7.0.6
PrestaShop 1.7.1.0
PrestaShop 1.7.1.0 beta1
PrestaShop 1.7.1.1
PrestaShop 1.7.1.2
PrestaShop 1.7.2.0
PrestaShop 1.7.2.0 RC 1
PrestaShop 1.7.2.0-RC.1.0
PrestaShop 1.7.2.1
PrestaShop 1.7.2.2
PrestaShop 1.7.2.3
PrestaShop 1.7.2.4
PrestaShop 1.7.2.5
PrestaShop 1.7.3.0
PrestaShop 1.7.3.0 beta 1
PrestaShop 1.7.3.0 RC 1
PrestaShop 1.7.3.1
PrestaShop 1.7.3.2
PrestaShop 1.7.3.3
PrestaShop 1.7.3.4
PrestaShop 1.7.4.0
PrestaShop 1.7.4.0 beta 1
PrestaShop 1.7.4.1
PrestaShop 1.7.4.2
PrestaShop 1.7.4.3
PrestaShop 1.7.4.4
PrestaShop 1.7.5.0
PrestaShop 1.7.5.0 beta 1
PrestaShop 1.7.5.0 RC 1
PrestaShop 1.7.5.0-beta.1
PrestaShop 1.7.5.0-RC.1
PrestaShop 1.7.5.1
PrestaShop 1.7.5.2
PrestaShop 1.7.6.0
PrestaShop 1.7.6.0 beta 1
PrestaShop 1.7.6.0 RC 1
PrestaShop 1.7.6.0 RC 2
PrestaShop 1.7.6.0-beta.1
PrestaShop 1.7.6.0-RC.1
PrestaShop 1.7.6.0-RC.2
PrestaShop 1.7.6.1
PrestaShop 1.7.6.2
PrestaShop 1.7.6.3
PrestaShop 1.7.6.4
PrestaShop 1.7.6.4 1
PrestaShop 1.7.6.5
PrestaShop 1.7.6.5 1
PrestaShop 1.7.6.6
PrestaShop 1.7.6.7
PrestaShop 1.7.6.8
PrestaShop 1.7.6.9
PrestaShop 1.7.7.0
PrestaShop 1.7.7.0 beta 1
PrestaShop 1.7.7.0 beta 2
PrestaShop 1.7.7.0 RC 1
PrestaShop 1.7.7.0-beta.1
PrestaShop 1.7.7.0-beta.2
PrestaShop 1.7.7.0-RC.1
PrestaShop 1.7.7.1
PrestaShop 1.7.7.2
PrestaShop 1.7.7.3
PrestaShop 1.7.7.4
PrestaShop 1.7.7.5
PrestaShop 1.7.7.6
PrestaShop 1.7.7.7
PrestaShop 1.7.7.8
PrestaShop 1.7.7.8 1
PrestaShop 1.7.8.0
PrestaShop 1.7.8.0 beta 1
PrestaShop 1.7.8.0 1
PrestaShop 1.7.8.0 RC 1
PrestaShop 1.7.8.0-beta.1
PrestaShop 1.7.8.0-RC.1
PrestaShop 1.7.8.1
PrestaShop 1.7.8.2
PrestaShop 1.7.8.2 1
PrestaShop 1.7.8.3
PrestaShop 1.7.8.4
PrestaShop 1.7.8.5
PrestaShop 1.7.8.6
PrestaShop 1.7.8.7
PrestaShop 1.7.8.7 1
PrestaShop 1.7.8.8
PrestaShop 1.7.8.9
PrestaShop 1.7.8.10
PrestaShop 1.7.8.11
PrestaShop 8.0.0
PrestaShop 8.0.1
PrestaShop 8.0.2
PrestaShop 8.0.3
PrestaShop 8.0.4
PrestaShop 8.0.5
PrestaShop 8.1.0
PrestaShop 8.1.1
PrestaShop 8.1.2
PrestaShop 8.1.3
PrestaShop 8.1.4
PrestaShop 8.1.5
PrestaShop 8.1.6
PrestaShop 8.1.7
PrestaShop 8.2.0
PrestaShop 8.2.1
PrestaShop 8.2.2
PrestaShop 8.2.3
PrestaShop 8.2.4
PrestaShop 9.0.0
PrestaShop 9.0.0-1.0-RC.1
PrestaShop 9.0.1
PrestaShop 9.0.1-1.0
PrestaShop 9.0.2
PrestaShop 9.0.2-2.0
PrestaShop 9.0.3
PrestaShop 9.0.3-3.0
PrestaShop 9.1.0-3.0-beta.1
PrestaShop 9.1.0-4.0-RC.1

Multiple stored XSS via unprotected back-office template variables p3

Skrevet den 7. juli 2026 af i PrestaShop

This vulnerability affects the following application versions:

PrestaShop 1.6.0.1
PrestaShop 1.6.0.1 alpha 1
PrestaShop 1.6.0.2
PrestaShop 1.6.0.2 alpha 2
PrestaShop 1.6.0.3
PrestaShop 1.6.0.3 beta 1
PrestaShop 1.6.0.4
PrestaShop 1.6.0.4 RC1
PrestaShop 1.6.0.5
PrestaShop 1.6.0.6
PrestaShop 1.6.0.7
PrestaShop 1.6.0.8
PrestaShop 1.6.0.9
PrestaShop 1.6.0.10
PrestaShop 1.6.0.11
PrestaShop 1.6.0.12
PrestaShop 1.6.0.13
PrestaShop 1.6.0.14
PrestaShop 1.6.1.0
PrestaShop 1.6.1.0 RC4
PrestaShop 1.6.1.0 RC5
PrestaShop 1.6.1.1
PrestaShop 1.6.1.1 RC1
PrestaShop 1.6.1.1 RC2
PrestaShop 1.6.1.2
PrestaShop 1.6.1.2 RC1
PrestaShop 1.6.1.2 RC2
PrestaShop 1.6.1.2 RC3
PrestaShop 1.6.1.2 RC4
PrestaShop 1.6.1.3
PrestaShop 1.6.1.3 RC1
PrestaShop 1.6.1.4
PrestaShop 1.6.1.5
PrestaShop 1.6.1.6
PrestaShop 1.6.1.7
PrestaShop 1.6.1.8
PrestaShop 1.6.1.9
PrestaShop 1.6.1.10
PrestaShop 1.6.1.11
PrestaShop 1.6.1.11 beta 1
PrestaShop 1.6.1.11-beta.1.0
PrestaShop 1.6.1.12
PrestaShop 1.6.1.13
PrestaShop 1.6.1.14
PrestaShop 1.6.1.15
PrestaShop 1.6.1.16
PrestaShop 1.6.1.17
PrestaShop 1.6.1.18
PrestaShop 1.6.1.19
PrestaShop 1.6.1.20
PrestaShop 1.6.1.21
PrestaShop 1.6.1.22
PrestaShop 1.6.1.23
PrestaShop 1.6.1.24
PrestaShop 1.7.0.0
PrestaShop 1.7.0.0 alpha3
PrestaShop 1.7.0.0 alpha4
PrestaShop 1.7.0.0 beta1
PrestaShop 1.7.0.0 beta2
PrestaShop 1.7.0.0 beta3
PrestaShop 1.7.0.0 RC0
PrestaShop 1.7.0.0 RC1
PrestaShop 1.7.0.0 RC2
PrestaShop 1.7.0.0 RC3
PrestaShop 1.7.0.1
PrestaShop 1.7.0.2
PrestaShop 1.7.0.3
PrestaShop 1.7.0.4
PrestaShop 1.7.0.5
PrestaShop 1.7.0.6
PrestaShop 1.7.1.0
PrestaShop 1.7.1.0 beta1
PrestaShop 1.7.1.1
PrestaShop 1.7.1.2
PrestaShop 1.7.2.0
PrestaShop 1.7.2.0 RC 1
PrestaShop 1.7.2.0-RC.1.0
PrestaShop 1.7.2.1
PrestaShop 1.7.2.2
PrestaShop 1.7.2.3
PrestaShop 1.7.2.4
PrestaShop 1.7.2.5
PrestaShop 1.7.3.0
PrestaShop 1.7.3.0 beta 1
PrestaShop 1.7.3.0 RC 1
PrestaShop 1.7.3.1
PrestaShop 1.7.3.2
PrestaShop 1.7.3.3
PrestaShop 1.7.3.4
PrestaShop 1.7.4.0
PrestaShop 1.7.4.0 beta 1
PrestaShop 1.7.4.1
PrestaShop 1.7.4.2
PrestaShop 1.7.4.3
PrestaShop 1.7.4.4
PrestaShop 1.7.5.0
PrestaShop 1.7.5.0 beta 1
PrestaShop 1.7.5.0 RC 1
PrestaShop 1.7.5.0-beta.1
PrestaShop 1.7.5.0-RC.1
PrestaShop 1.7.5.1
PrestaShop 1.7.5.2
PrestaShop 1.7.6.0
PrestaShop 1.7.6.0 beta 1
PrestaShop 1.7.6.0 RC 1
PrestaShop 1.7.6.0 RC 2
PrestaShop 1.7.6.0-beta.1
PrestaShop 1.7.6.0-RC.1
PrestaShop 1.7.6.0-RC.2
PrestaShop 1.7.6.1
PrestaShop 1.7.6.2
PrestaShop 1.7.6.3
PrestaShop 1.7.6.4
PrestaShop 1.7.6.4 1
PrestaShop 1.7.6.5
PrestaShop 1.7.6.5 1
PrestaShop 1.7.6.6
PrestaShop 1.7.6.7
PrestaShop 1.7.6.8
PrestaShop 1.7.6.9
PrestaShop 1.7.7.0
PrestaShop 1.7.7.0 beta 1
PrestaShop 1.7.7.0 beta 2
PrestaShop 1.7.7.0 RC 1
PrestaShop 1.7.7.0-beta.1
PrestaShop 1.7.7.0-beta.2
PrestaShop 1.7.7.0-RC.1
PrestaShop 1.7.7.1
PrestaShop 1.7.7.2
PrestaShop 1.7.7.3
PrestaShop 1.7.7.4
PrestaShop 1.7.7.5
PrestaShop 1.7.7.6
PrestaShop 1.7.7.7
PrestaShop 1.7.7.8
PrestaShop 1.7.7.8 1
PrestaShop 1.7.8.0
PrestaShop 1.7.8.0 beta 1
PrestaShop 1.7.8.0 1
PrestaShop 1.7.8.0 RC 1
PrestaShop 1.7.8.0-beta.1
PrestaShop 1.7.8.0-RC.1
PrestaShop 1.7.8.1
PrestaShop 1.7.8.2
PrestaShop 1.7.8.2 1
PrestaShop 1.7.8.3
PrestaShop 1.7.8.4
PrestaShop 1.7.8.5
PrestaShop 1.7.8.6
PrestaShop 1.7.8.7
PrestaShop 1.7.8.7 1
PrestaShop 1.7.8.8
PrestaShop 1.7.8.9
PrestaShop 1.7.8.10
PrestaShop 1.7.8.11
PrestaShop 8.0.0
PrestaShop 8.0.1
PrestaShop 8.0.2
PrestaShop 8.0.3
PrestaShop 8.0.4
PrestaShop 8.0.5
PrestaShop 8.1.0
PrestaShop 8.1.1
PrestaShop 8.1.2
PrestaShop 8.1.3
PrestaShop 8.1.4
PrestaShop 8.1.5
PrestaShop 8.1.6
PrestaShop 8.1.7
PrestaShop 8.2.0
PrestaShop 8.2.1
PrestaShop 8.2.2
PrestaShop 8.2.3
PrestaShop 8.2.4
PrestaShop 9.0.0
PrestaShop 9.0.0-1.0-RC.1
PrestaShop 9.0.1
PrestaShop 9.0.1-1.0
PrestaShop 9.0.2
PrestaShop 9.0.2-2.0
PrestaShop 9.0.3
PrestaShop 9.0.3-3.0
PrestaShop 9.1.0-3.0-beta.1
PrestaShop 9.1.0-4.0-RC.1

Multiple stored XSS via unprotected back-office template variables p4

Skrevet den 7. juli 202630. september 2026 af i PrestaShop

This vulnerability affects the following application versions:

PrestaShop 1.6.0.1
PrestaShop 1.6.0.1 alpha 1
PrestaShop 1.6.0.2
PrestaShop 1.6.0.2 alpha 2
PrestaShop 1.6.0.3
PrestaShop 1.6.0.3 beta 1
PrestaShop 1.6.0.4
PrestaShop 1.6.0.4 RC1
PrestaShop 1.6.0.5
PrestaShop 1.6.0.6
PrestaShop 1.6.0.7
PrestaShop 1.6.0.8
PrestaShop 1.6.0.9
PrestaShop 1.6.0.10
PrestaShop 1.6.0.11
PrestaShop 1.6.0.12
PrestaShop 1.6.0.13
PrestaShop 1.6.0.14
PrestaShop 1.6.1.0
PrestaShop 1.6.1.0 RC4
PrestaShop 1.6.1.0 RC5
PrestaShop 1.6.1.1
PrestaShop 1.6.1.1 RC1
PrestaShop 1.6.1.1 RC2
PrestaShop 1.6.1.2
PrestaShop 1.6.1.2 RC1
PrestaShop 1.6.1.2 RC2
PrestaShop 1.6.1.2 RC3
PrestaShop 1.6.1.2 RC4
PrestaShop 1.6.1.3
PrestaShop 1.6.1.3 RC1
PrestaShop 1.6.1.4
PrestaShop 1.6.1.5
PrestaShop 1.6.1.6
PrestaShop 1.6.1.7
PrestaShop 1.6.1.8
PrestaShop 1.6.1.9
PrestaShop 1.6.1.10
PrestaShop 1.6.1.11
PrestaShop 1.6.1.11 beta 1
PrestaShop 1.6.1.11-beta.1.0
PrestaShop 1.6.1.12
PrestaShop 1.6.1.13
PrestaShop 1.6.1.14
PrestaShop 1.6.1.15
PrestaShop 1.6.1.16
PrestaShop 1.6.1.17
PrestaShop 1.6.1.18
PrestaShop 1.6.1.19
PrestaShop 1.6.1.20
PrestaShop 1.6.1.21
PrestaShop 1.6.1.22
PrestaShop 1.6.1.23
PrestaShop 1.6.1.24
PrestaShop 1.7.0.0
PrestaShop 1.7.0.0 alpha3
PrestaShop 1.7.0.0 alpha4
PrestaShop 1.7.0.0 beta1
PrestaShop 1.7.0.0 beta2
PrestaShop 1.7.0.0 beta3
PrestaShop 1.7.0.0 RC0
PrestaShop 1.7.0.0 RC1
PrestaShop 1.7.0.0 RC2
PrestaShop 1.7.0.0 RC3
PrestaShop 1.7.0.1
PrestaShop 1.7.0.2
PrestaShop 1.7.0.3
PrestaShop 1.7.0.4
PrestaShop 1.7.0.5
PrestaShop 1.7.0.6
PrestaShop 1.7.1.0
PrestaShop 1.7.1.0 beta1
PrestaShop 1.7.1.1
PrestaShop 1.7.1.2
PrestaShop 1.7.2.0
PrestaShop 1.7.2.0 RC 1
PrestaShop 1.7.2.0-RC.1.0
PrestaShop 1.7.2.1
PrestaShop 1.7.2.2
PrestaShop 1.7.2.3
PrestaShop 1.7.2.4
PrestaShop 1.7.2.5
PrestaShop 1.7.3.0
PrestaShop 1.7.3.0 beta 1
PrestaShop 1.7.3.0 RC 1
PrestaShop 1.7.3.1
PrestaShop 1.7.3.2
PrestaShop 1.7.3.3
PrestaShop 1.7.3.4
PrestaShop 1.7.4.0
PrestaShop 1.7.4.0 beta 1
PrestaShop 1.7.4.1
PrestaShop 1.7.4.2
PrestaShop 1.7.4.3
PrestaShop 1.7.4.4
PrestaShop 1.7.5.0
PrestaShop 1.7.5.0 beta 1
PrestaShop 1.7.5.0 RC 1
PrestaShop 1.7.5.0-beta.1
PrestaShop 1.7.5.0-RC.1
PrestaShop 1.7.5.1
PrestaShop 1.7.5.2
PrestaShop 1.7.6.0
PrestaShop 1.7.6.0 beta 1
PrestaShop 1.7.6.0 RC 1
PrestaShop 1.7.6.0 RC 2
PrestaShop 1.7.6.0-beta.1
PrestaShop 1.7.6.0-RC.1
PrestaShop 1.7.6.0-RC.2
PrestaShop 1.7.6.1
PrestaShop 1.7.6.2
PrestaShop 1.7.6.3
PrestaShop 1.7.6.4
PrestaShop 1.7.6.4 1
PrestaShop 1.7.6.5
PrestaShop 1.7.6.5 1
PrestaShop 1.7.6.6
PrestaShop 1.7.6.7
PrestaShop 1.7.6.8
PrestaShop 1.7.6.9
PrestaShop 1.7.7.0
PrestaShop 1.7.7.0 beta 1
PrestaShop 1.7.7.0 beta 2
PrestaShop 1.7.7.0 RC 1
PrestaShop 1.7.7.0-beta.1
PrestaShop 1.7.7.0-beta.2
PrestaShop 1.7.7.0-RC.1
PrestaShop 1.7.7.1
PrestaShop 1.7.7.2
PrestaShop 1.7.7.3
PrestaShop 1.7.7.4
PrestaShop 1.7.7.5
PrestaShop 1.7.7.6
PrestaShop 1.7.7.7
PrestaShop 1.7.7.8
PrestaShop 1.7.7.8 1
PrestaShop 1.7.8.0
PrestaShop 1.7.8.0 beta 1
PrestaShop 1.7.8.0 1
PrestaShop 1.7.8.0 RC 1
PrestaShop 1.7.8.0-beta.1
PrestaShop 1.7.8.0-RC.1
PrestaShop 1.7.8.1
PrestaShop 1.7.8.2
PrestaShop 1.7.8.2 1
PrestaShop 1.7.8.3
PrestaShop 1.7.8.4
PrestaShop 1.7.8.5
PrestaShop 1.7.8.6
PrestaShop 1.7.8.7
PrestaShop 1.7.8.7 1
PrestaShop 1.7.8.8
PrestaShop 1.7.8.9
PrestaShop 1.7.8.10
PrestaShop 1.7.8.11
PrestaShop 8.0.0
PrestaShop 8.0.1
PrestaShop 8.0.2
PrestaShop 8.0.3
PrestaShop 8.0.4
PrestaShop 8.0.5
PrestaShop 8.1.0
PrestaShop 8.1.1
PrestaShop 8.1.2
PrestaShop 8.1.3
PrestaShop 8.1.4
PrestaShop 8.1.5
PrestaShop 8.1.6
PrestaShop 8.1.7
PrestaShop 8.2.0
PrestaShop 8.2.1
PrestaShop 8.2.2
PrestaShop 8.2.3
PrestaShop 8.2.4
PrestaShop 8.2.5
PrestaShop 8.2.6
PrestaShop 8.2.7
PrestaShop 8.2.8
PrestaShop 9.0.0
PrestaShop 9.0.0-1.0-RC.1
PrestaShop 9.0.1
PrestaShop 9.0.1-1.0
PrestaShop 9.0.2
PrestaShop 9.0.2-2.0
PrestaShop 9.0.3
PrestaShop 9.0.3-3.0
PrestaShop 9.1.0
PrestaShop 9.1.0-3.0-beta.1
PrestaShop 9.1.0-4.0
PrestaShop 9.1.0-4.0-RC.1
PrestaShop 9.1.1
PrestaShop 9.1.2
PrestaShop 9.1.3
PrestaShop 9.1.3-5.0
PrestaShop 9.1.4
PrestaShop 9.1.4-5.0
PrestaShop 9.1.5
PrestaShop 9.1.5-5.0
PrestaShop 9.2.0
PrestaShop 9.2.0-6.0
PrestaShop 9.2.0-6.0-beta.1
PrestaShop 9.2.0-6.0-RC.1

Multiple stored XSS via unprotected back-office template variables p5

Skrevet den 7. juli 2026 af i PrestaShop

This vulnerability affects the following application versions:

PrestaShop 1.6.0.1
PrestaShop 1.6.0.1 alpha 1
PrestaShop 1.6.0.2
PrestaShop 1.6.0.2 alpha 2
PrestaShop 1.6.0.3
PrestaShop 1.6.0.3 beta 1
PrestaShop 1.6.0.4
PrestaShop 1.6.0.4 RC1
PrestaShop 1.6.0.5
PrestaShop 1.6.0.6
PrestaShop 1.6.0.7
PrestaShop 1.6.0.8
PrestaShop 1.6.0.9
PrestaShop 1.6.0.10
PrestaShop 1.6.0.11
PrestaShop 1.6.0.12
PrestaShop 1.6.0.13
PrestaShop 1.6.0.14
PrestaShop 1.6.1.0
PrestaShop 1.6.1.0 RC4
PrestaShop 1.6.1.0 RC5
PrestaShop 1.6.1.1
PrestaShop 1.6.1.1 RC1
PrestaShop 1.6.1.1 RC2
PrestaShop 1.6.1.2
PrestaShop 1.6.1.2 RC1
PrestaShop 1.6.1.2 RC2
PrestaShop 1.6.1.2 RC3
PrestaShop 1.6.1.2 RC4
PrestaShop 1.6.1.3
PrestaShop 1.6.1.3 RC1
PrestaShop 1.6.1.4
PrestaShop 1.6.1.5
PrestaShop 1.6.1.6
PrestaShop 1.6.1.7
PrestaShop 1.6.1.8
PrestaShop 1.6.1.9
PrestaShop 1.6.1.10
PrestaShop 1.6.1.11
PrestaShop 1.6.1.11 beta 1
PrestaShop 1.6.1.11-beta.1.0
PrestaShop 1.6.1.12
PrestaShop 1.6.1.13
PrestaShop 1.6.1.14
PrestaShop 1.6.1.15
PrestaShop 1.6.1.16
PrestaShop 1.6.1.17
PrestaShop 1.6.1.18
PrestaShop 1.6.1.19
PrestaShop 1.6.1.20
PrestaShop 1.6.1.21
PrestaShop 1.6.1.22
PrestaShop 1.6.1.23
PrestaShop 1.6.1.24
PrestaShop 1.7.0.0
PrestaShop 1.7.0.0 alpha3
PrestaShop 1.7.0.0 alpha4
PrestaShop 1.7.0.0 beta1
PrestaShop 1.7.0.0 beta2
PrestaShop 1.7.0.0 beta3
PrestaShop 1.7.0.0 RC0
PrestaShop 1.7.0.0 RC1
PrestaShop 1.7.0.0 RC2
PrestaShop 1.7.0.0 RC3
PrestaShop 1.7.0.1
PrestaShop 1.7.0.2
PrestaShop 1.7.0.3
PrestaShop 1.7.0.4
PrestaShop 1.7.0.5
PrestaShop 1.7.0.6
PrestaShop 1.7.1.0
PrestaShop 1.7.1.0 beta1
PrestaShop 1.7.1.1
PrestaShop 1.7.1.2
PrestaShop 1.7.2.0
PrestaShop 1.7.2.0 RC 1
PrestaShop 1.7.2.0-RC.1.0
PrestaShop 1.7.2.1
PrestaShop 1.7.2.2
PrestaShop 1.7.2.3
PrestaShop 1.7.2.4
PrestaShop 1.7.2.5
PrestaShop 1.7.3.0
PrestaShop 1.7.3.0 beta 1
PrestaShop 1.7.3.0 RC 1
PrestaShop 1.7.3.1
PrestaShop 1.7.3.2
PrestaShop 1.7.3.3
PrestaShop 1.7.3.4
PrestaShop 1.7.4.0
PrestaShop 1.7.4.0 beta 1
PrestaShop 1.7.4.1
PrestaShop 1.7.4.2
PrestaShop 1.7.4.3
PrestaShop 1.7.4.4
PrestaShop 1.7.5.0
PrestaShop 1.7.5.0 beta 1
PrestaShop 1.7.5.0 RC 1
PrestaShop 1.7.5.0-beta.1
PrestaShop 1.7.5.0-RC.1
PrestaShop 1.7.5.1
PrestaShop 1.7.5.2
PrestaShop 1.7.6.0
PrestaShop 1.7.6.0 beta 1
PrestaShop 1.7.6.0 RC 1
PrestaShop 1.7.6.0 RC 2
PrestaShop 1.7.6.0-beta.1
PrestaShop 1.7.6.0-RC.1
PrestaShop 1.7.6.0-RC.2
PrestaShop 1.7.6.1
PrestaShop 1.7.6.2
PrestaShop 1.7.6.3
PrestaShop 1.7.6.4
PrestaShop 1.7.6.4 1
PrestaShop 1.7.6.5
PrestaShop 1.7.6.5 1
PrestaShop 1.7.6.6
PrestaShop 1.7.6.7
PrestaShop 1.7.6.8
PrestaShop 1.7.6.9
PrestaShop 1.7.7.0
PrestaShop 1.7.7.0 beta 1
PrestaShop 1.7.7.0 beta 2
PrestaShop 1.7.7.0 RC 1
PrestaShop 1.7.7.0-beta.1
PrestaShop 1.7.7.0-beta.2
PrestaShop 1.7.7.0-RC.1
PrestaShop 1.7.7.1
PrestaShop 1.7.7.2
PrestaShop 1.7.7.3
PrestaShop 1.7.7.4
PrestaShop 1.7.7.5
PrestaShop 1.7.7.6
PrestaShop 1.7.7.7
PrestaShop 1.7.7.8
PrestaShop 1.7.7.8 1
PrestaShop 1.7.8.0
PrestaShop 1.7.8.0 beta 1
PrestaShop 1.7.8.0 1
PrestaShop 1.7.8.0 RC 1
PrestaShop 1.7.8.0-beta.1
PrestaShop 1.7.8.0-RC.1
PrestaShop 1.7.8.1
PrestaShop 1.7.8.2
PrestaShop 1.7.8.2 1
PrestaShop 1.7.8.3
PrestaShop 1.7.8.4
PrestaShop 1.7.8.5
PrestaShop 1.7.8.6
PrestaShop 1.7.8.7
PrestaShop 1.7.8.7 1
PrestaShop 1.7.8.8
PrestaShop 1.7.8.9
PrestaShop 1.7.8.10
PrestaShop 1.7.8.11
PrestaShop 8.0.0
PrestaShop 8.0.1
PrestaShop 8.0.2
PrestaShop 8.0.3
PrestaShop 8.0.4
PrestaShop 8.0.5
PrestaShop 8.1.0
PrestaShop 8.1.1
PrestaShop 8.1.2
PrestaShop 8.1.3
PrestaShop 8.1.4
PrestaShop 8.1.5
PrestaShop 8.1.6
PrestaShop 8.1.7
PrestaShop 8.2.0
PrestaShop 8.2.1
PrestaShop 8.2.2
PrestaShop 8.2.3
PrestaShop 8.2.4
PrestaShop 9.0.0
PrestaShop 9.0.0-1.0-RC.1
PrestaShop 9.0.1
PrestaShop 9.0.1-1.0
PrestaShop 9.0.2
PrestaShop 9.0.2-2.0
PrestaShop 9.0.3
PrestaShop 9.0.3-3.0
PrestaShop 9.1.0-3.0-beta.1
PrestaShop 9.1.0-4.0-RC.1

Stored Cross-Site Scripting in PrestaShop Customer Service Thread View

Skrevet den 24. juni 2026 af i PrestaShop

An unauthenticated attacker can submit the public Contact Us form with an RFC 5321 quoted-string email address carrying an HTML attribute-injection payload that passes isEmail() validation. The payload is stored and later rendered without HTML escaping in the back-office Customer Service thread view, executing arbitrary JavaScript in a privileged admin session and enabling back-office takeover.

This vulnerability affects the following application versions:

PrestaShop 1.6.0.4
PrestaShop 1.6.0.4 RC1
PrestaShop 1.6.0.5
PrestaShop 1.6.0.6
PrestaShop 1.6.0.7
PrestaShop 1.6.0.8
PrestaShop 1.6.0.9
PrestaShop 1.6.0.10
PrestaShop 1.6.0.11
PrestaShop 1.6.0.12
PrestaShop 1.6.0.13
PrestaShop 1.6.0.14
PrestaShop 1.6.1.0
PrestaShop 1.6.1.0 RC4
PrestaShop 1.6.1.0 RC5
PrestaShop 1.6.1.1
PrestaShop 1.6.1.1 RC1
PrestaShop 1.6.1.1 RC2
PrestaShop 1.6.1.2
PrestaShop 1.6.1.2 RC1
PrestaShop 1.6.1.2 RC2
PrestaShop 1.6.1.2 RC3
PrestaShop 1.6.1.2 RC4
PrestaShop 1.6.1.3
PrestaShop 1.6.1.3 RC1
PrestaShop 1.6.1.4
PrestaShop 1.6.1.5
PrestaShop 1.6.1.6
PrestaShop 1.6.1.7
PrestaShop 1.6.1.8
PrestaShop 1.6.1.9
PrestaShop 1.6.1.10
PrestaShop 1.6.1.11
PrestaShop 1.6.1.11 beta 1
PrestaShop 1.6.1.11-beta.1.0
PrestaShop 1.6.1.12
PrestaShop 1.6.1.13
PrestaShop 1.6.1.14
PrestaShop 1.6.1.15
PrestaShop 1.6.1.16
PrestaShop 1.6.1.17
PrestaShop 1.6.1.18
PrestaShop 1.6.1.19
PrestaShop 1.6.1.20
PrestaShop 1.6.1.21
PrestaShop 1.6.1.22
PrestaShop 1.6.1.23
PrestaShop 1.6.1.24
PrestaShop 1.7.0.0
PrestaShop 1.7.0.0 alpha3
PrestaShop 1.7.0.0 alpha4
PrestaShop 1.7.0.0 beta1
PrestaShop 1.7.0.0 beta2
PrestaShop 1.7.0.0 beta3
PrestaShop 1.7.0.0 RC0
PrestaShop 1.7.0.0 RC1
PrestaShop 1.7.0.0 RC2
PrestaShop 1.7.0.0 RC3
PrestaShop 1.7.0.1
PrestaShop 1.7.0.2
PrestaShop 1.7.0.3
PrestaShop 1.7.0.4
PrestaShop 1.7.0.5
PrestaShop 1.7.0.6
PrestaShop 1.7.1.0
PrestaShop 1.7.1.0 beta1
PrestaShop 1.7.1.1
PrestaShop 1.7.1.2
PrestaShop 1.7.2.0
PrestaShop 1.7.2.0 RC 1
PrestaShop 1.7.2.0-RC.1.0
PrestaShop 1.7.2.1
PrestaShop 1.7.2.2
PrestaShop 1.7.2.3
PrestaShop 1.7.2.4
PrestaShop 1.7.2.5
PrestaShop 1.7.3.0
PrestaShop 1.7.3.0 beta 1
PrestaShop 1.7.3.0 RC 1
PrestaShop 1.7.3.1
PrestaShop 1.7.3.2
PrestaShop 1.7.3.3
PrestaShop 1.7.3.4
PrestaShop 1.7.4.0
PrestaShop 1.7.4.0 beta 1
PrestaShop 1.7.4.1
PrestaShop 1.7.4.2
PrestaShop 1.7.4.3
PrestaShop 1.7.4.4
PrestaShop 1.7.5.0
PrestaShop 1.7.5.0 beta 1
PrestaShop 1.7.5.0 RC 1
PrestaShop 1.7.5.0-beta.1
PrestaShop 1.7.5.0-RC.1
PrestaShop 1.7.5.1
PrestaShop 1.7.5.2
PrestaShop 1.7.6.0
PrestaShop 1.7.6.0 beta 1
PrestaShop 1.7.6.0 RC 1
PrestaShop 1.7.6.0 RC 2
PrestaShop 1.7.6.0-beta.1
PrestaShop 1.7.6.0-RC.1
PrestaShop 1.7.6.0-RC.2
PrestaShop 1.7.6.1
PrestaShop 1.7.6.2
PrestaShop 1.7.6.3
PrestaShop 1.7.6.4
PrestaShop 1.7.6.4 1
PrestaShop 1.7.6.5
PrestaShop 1.7.6.5 1
PrestaShop 1.7.6.6
PrestaShop 1.7.6.7
PrestaShop 1.7.6.8
PrestaShop 1.7.6.9
PrestaShop 1.7.7.0
PrestaShop 1.7.7.0 beta 1
PrestaShop 1.7.7.0 beta 2
PrestaShop 1.7.7.0 RC 1
PrestaShop 1.7.7.0-beta.1
PrestaShop 1.7.7.0-beta.2
PrestaShop 1.7.7.0-RC.1
PrestaShop 1.7.7.1
PrestaShop 1.7.7.2
PrestaShop 1.7.7.3
PrestaShop 1.7.7.4
PrestaShop 1.7.7.5
PrestaShop 1.7.7.6
PrestaShop 1.7.7.7
PrestaShop 1.7.7.8
PrestaShop 1.7.7.8 1
PrestaShop 1.7.8.0
PrestaShop 1.7.8.0 beta 1
PrestaShop 1.7.8.0 1
PrestaShop 1.7.8.0 RC 1
PrestaShop 1.7.8.0-beta.1
PrestaShop 1.7.8.0-RC.1
PrestaShop 1.7.8.1
PrestaShop 1.7.8.2
PrestaShop 1.7.8.2 1
PrestaShop 1.7.8.3
PrestaShop 1.7.8.4
PrestaShop 1.7.8.5
PrestaShop 1.7.8.6
PrestaShop 1.7.8.7
PrestaShop 1.7.8.7 1
PrestaShop 1.7.8.8
PrestaShop 1.7.8.9
PrestaShop 1.7.8.10
PrestaShop 1.7.8.11
PrestaShop 8.0.0
PrestaShop 8.0.1
PrestaShop 8.0.2
PrestaShop 8.0.3
PrestaShop 8.0.4
PrestaShop 8.0.5
PrestaShop 8.1.0
PrestaShop 8.1.1
PrestaShop 8.1.2
PrestaShop 8.1.3
PrestaShop 8.1.4
PrestaShop 8.1.5
PrestaShop 8.1.6
PrestaShop 8.1.7
PrestaShop 8.2.0
PrestaShop 8.2.1
PrestaShop 8.2.2
PrestaShop 8.2.3
PrestaShop 8.2.4
PrestaShop 8.2.5
PrestaShop 9.0.0
PrestaShop 9.0.0-1.0-RC.1
PrestaShop 9.0.1
PrestaShop 9.0.1-1.0
PrestaShop 9.0.2
PrestaShop 9.0.2-2.0
PrestaShop 9.0.3
PrestaShop 9.0.3-3.0
PrestaShop 9.1.0
PrestaShop 9.1.0-3.0-beta.1
PrestaShop 9.1.0-4.0
PrestaShop 9.1.0-4.0-RC.1

Multiple stored XSS via unprotected back-office template variables p1

Skrevet den 22. juni 2026 af i PrestaShop

This vulnerability affects the following application versions:

PrestaShop 1.6.0.1
PrestaShop 1.6.0.1 alpha 1
PrestaShop 1.6.0.2
PrestaShop 1.6.0.2 alpha 2
PrestaShop 1.6.0.3
PrestaShop 1.6.0.3 beta 1
PrestaShop 1.6.0.4
PrestaShop 1.6.0.4 RC1
PrestaShop 1.6.0.5
PrestaShop 1.6.0.6
PrestaShop 1.6.0.7
PrestaShop 1.6.0.8
PrestaShop 1.6.0.9
PrestaShop 1.6.0.10
PrestaShop 1.6.0.11
PrestaShop 1.6.0.12
PrestaShop 1.6.0.13
PrestaShop 1.6.0.14
PrestaShop 1.6.1.0
PrestaShop 1.6.1.0 RC4
PrestaShop 1.6.1.0 RC5
PrestaShop 1.6.1.1
PrestaShop 1.6.1.1 RC1
PrestaShop 1.6.1.1 RC2
PrestaShop 1.6.1.2
PrestaShop 1.6.1.2 RC1
PrestaShop 1.6.1.2 RC2
PrestaShop 1.6.1.2 RC3
PrestaShop 1.6.1.2 RC4
PrestaShop 1.6.1.3
PrestaShop 1.6.1.3 RC1
PrestaShop 1.6.1.4
PrestaShop 1.6.1.5
PrestaShop 1.6.1.6
PrestaShop 1.6.1.7
PrestaShop 1.6.1.8
PrestaShop 1.6.1.9
PrestaShop 1.6.1.10
PrestaShop 1.6.1.11
PrestaShop 1.6.1.11 beta 1
PrestaShop 1.6.1.11-beta.1.0
PrestaShop 1.6.1.12
PrestaShop 1.6.1.13
PrestaShop 1.6.1.14
PrestaShop 1.6.1.15
PrestaShop 1.6.1.16
PrestaShop 1.6.1.17
PrestaShop 1.6.1.18
PrestaShop 1.6.1.19
PrestaShop 1.6.1.20
PrestaShop 1.6.1.21
PrestaShop 1.6.1.22
PrestaShop 1.6.1.23
PrestaShop 1.6.1.24
PrestaShop 1.7.0.0
PrestaShop 1.7.0.0 alpha3
PrestaShop 1.7.0.0 alpha4
PrestaShop 1.7.0.0 beta1
PrestaShop 1.7.0.0 beta2
PrestaShop 1.7.0.0 beta3
PrestaShop 1.7.0.0 RC0
PrestaShop 1.7.0.0 RC1
PrestaShop 1.7.0.0 RC2
PrestaShop 1.7.0.0 RC3
PrestaShop 1.7.0.1
PrestaShop 1.7.0.2
PrestaShop 1.7.0.3
PrestaShop 1.7.0.4
PrestaShop 1.7.0.5
PrestaShop 1.7.0.6
PrestaShop 1.7.1.0
PrestaShop 1.7.1.0 beta1
PrestaShop 1.7.1.1
PrestaShop 1.7.1.2
PrestaShop 1.7.2.0
PrestaShop 1.7.2.0 RC 1
PrestaShop 1.7.2.0-RC.1.0
PrestaShop 1.7.2.1
PrestaShop 1.7.2.2
PrestaShop 1.7.2.3
PrestaShop 1.7.2.4
PrestaShop 1.7.2.5
PrestaShop 1.7.3.0
PrestaShop 1.7.3.0 beta 1
PrestaShop 1.7.3.0 RC 1
PrestaShop 1.7.3.1
PrestaShop 1.7.3.2
PrestaShop 1.7.3.3
PrestaShop 1.7.3.4
PrestaShop 1.7.4.0
PrestaShop 1.7.4.0 beta 1
PrestaShop 1.7.4.1
PrestaShop 1.7.4.2
PrestaShop 1.7.4.3
PrestaShop 1.7.4.4
PrestaShop 1.7.5.0
PrestaShop 1.7.5.0 beta 1
PrestaShop 1.7.5.0 RC 1
PrestaShop 1.7.5.0-beta.1
PrestaShop 1.7.5.0-RC.1
PrestaShop 1.7.5.1
PrestaShop 1.7.5.2
PrestaShop 1.7.6.0
PrestaShop 1.7.6.0 beta 1
PrestaShop 1.7.6.0 RC 1
PrestaShop 1.7.6.0 RC 2
PrestaShop 1.7.6.0-beta.1
PrestaShop 1.7.6.0-RC.1
PrestaShop 1.7.6.0-RC.2
PrestaShop 1.7.6.1
PrestaShop 1.7.6.2
PrestaShop 1.7.6.3
PrestaShop 1.7.6.4
PrestaShop 1.7.6.4 1
PrestaShop 1.7.6.5
PrestaShop 1.7.6.5 1
PrestaShop 1.7.6.6
PrestaShop 1.7.6.7
PrestaShop 1.7.6.8
PrestaShop 1.7.6.9
PrestaShop 1.7.7.0
PrestaShop 1.7.7.0 beta 1
PrestaShop 1.7.7.0 beta 2
PrestaShop 1.7.7.0 RC 1
PrestaShop 1.7.7.0-beta.1
PrestaShop 1.7.7.0-beta.2
PrestaShop 1.7.7.0-RC.1
PrestaShop 1.7.7.1
PrestaShop 1.7.7.2
PrestaShop 1.7.7.3
PrestaShop 1.7.7.4
PrestaShop 1.7.7.5
PrestaShop 1.7.7.6
PrestaShop 1.7.7.7
PrestaShop 1.7.7.8
PrestaShop 1.7.7.8 1
PrestaShop 1.7.8.0
PrestaShop 1.7.8.0 beta 1
PrestaShop 1.7.8.0 1
PrestaShop 1.7.8.0 RC 1
PrestaShop 1.7.8.0-beta.1
PrestaShop 1.7.8.0-RC.1
PrestaShop 1.7.8.1
PrestaShop 1.7.8.2
PrestaShop 1.7.8.2 1
PrestaShop 1.7.8.3
PrestaShop 1.7.8.4
PrestaShop 1.7.8.5
PrestaShop 1.7.8.6
PrestaShop 1.7.8.7
PrestaShop 1.7.8.7 1
PrestaShop 1.7.8.8
PrestaShop 1.7.8.9
PrestaShop 1.7.8.10
PrestaShop 1.7.8.11
PrestaShop 8.0.0
PrestaShop 8.0.1
PrestaShop 8.0.2
PrestaShop 8.0.3
PrestaShop 8.0.4
PrestaShop 8.0.5
PrestaShop 8.1.0
PrestaShop 8.1.1
PrestaShop 8.1.2
PrestaShop 8.1.3
PrestaShop 8.1.4
PrestaShop 8.1.5
PrestaShop 8.1.6
PrestaShop 8.1.7
PrestaShop 8.2.0
PrestaShop 8.2.1
PrestaShop 8.2.2
PrestaShop 8.2.3
PrestaShop 8.2.4
PrestaShop 9.0.0
PrestaShop 9.0.0-1.0-RC.1
PrestaShop 9.0.1
PrestaShop 9.0.1-1.0
PrestaShop 9.0.2
PrestaShop 9.0.2-2.0
PrestaShop 9.0.3
PrestaShop 9.0.3-3.0
PrestaShop 9.1.0-3.0-beta.1

Improper use of validation framework (PrivateNoteType 1.7.6.x fix)

Skrevet den 11. juni 2026 af i PrestaShop

An authenticated high-privilege user can bypass input validation on the customer private note field, allowing HTML/JavaScript injection (XSS). The fix adds a CleanHtml sanitization constraint to PrivateNoteType. Corrected patch for PrestaShop 1.7.6.x, where the prior patch referenced an undefined $this->translator property and caused HTTP 500.

This vulnerability affects the following application versions:

PrestaShop 1.7.6.0
PrestaShop 1.7.6.0 beta 1
PrestaShop 1.7.6.0 RC 1
PrestaShop 1.7.6.0 RC 2
PrestaShop 1.7.6.0-beta.1
PrestaShop 1.7.6.0-RC.1
PrestaShop 1.7.6.0-RC.2
PrestaShop 1.7.6.1
PrestaShop 1.7.6.2
PrestaShop 1.7.6.3
PrestaShop 1.7.6.4
PrestaShop 1.7.6.4 1
PrestaShop 1.7.6.5
PrestaShop 1.7.6.5 1
PrestaShop 1.7.6.6
PrestaShop 1.7.6.7
PrestaShop 1.7.6.8
PrestaShop 1.7.6.9

Improper use of validation framework

Skrevet den 12. maj 20265. juni 2026 af i PrestaShop

An improper use of the validation framework (CWE-1173) in PrestaShop allows an authenticated attacker with high privileges to bypass input validation checks in certain form fields, including customer private notes, order internal notes, feature values, and manufacturer data.

This vulnerability affects the following application versions:

PrestaShop 1.6.0.1
PrestaShop 1.6.0.1 alpha 1
PrestaShop 1.6.0.2
PrestaShop 1.6.0.2 alpha 2
PrestaShop 1.6.0.3
PrestaShop 1.6.0.3 beta 1
PrestaShop 1.6.0.4
PrestaShop 1.6.0.4 RC1
PrestaShop 1.6.0.5
PrestaShop 1.6.0.6
PrestaShop 1.6.0.7
PrestaShop 1.6.0.8
PrestaShop 1.6.0.9
PrestaShop 1.6.0.10
PrestaShop 1.6.0.11
PrestaShop 1.6.0.12
PrestaShop 1.6.0.13
PrestaShop 1.6.0.14
PrestaShop 1.6.1.0
PrestaShop 1.6.1.0 RC4
PrestaShop 1.6.1.0 RC5
PrestaShop 1.6.1.1
PrestaShop 1.6.1.1 RC1
PrestaShop 1.6.1.1 RC2
PrestaShop 1.6.1.2
PrestaShop 1.6.1.2 RC1
PrestaShop 1.6.1.2 RC2
PrestaShop 1.6.1.2 RC3
PrestaShop 1.6.1.2 RC4
PrestaShop 1.6.1.3
PrestaShop 1.6.1.3 RC1
PrestaShop 1.6.1.4
PrestaShop 1.6.1.5
PrestaShop 1.6.1.6
PrestaShop 1.6.1.7
PrestaShop 1.6.1.8
PrestaShop 1.6.1.9
PrestaShop 1.6.1.10
PrestaShop 1.6.1.11
PrestaShop 1.6.1.11 beta 1
PrestaShop 1.6.1.11-beta.1.0
PrestaShop 1.6.1.12
PrestaShop 1.6.1.13
PrestaShop 1.6.1.14
PrestaShop 1.6.1.15
PrestaShop 1.6.1.16
PrestaShop 1.6.1.17
PrestaShop 1.6.1.18
PrestaShop 1.6.1.19
PrestaShop 1.6.1.20
PrestaShop 1.6.1.21
PrestaShop 1.6.1.22
PrestaShop 1.6.1.23
PrestaShop 1.6.1.24
PrestaShop 1.7.0.0
PrestaShop 1.7.0.0 alpha3
PrestaShop 1.7.0.0 alpha4
PrestaShop 1.7.0.0 beta1
PrestaShop 1.7.0.0 beta2
PrestaShop 1.7.0.0 beta3
PrestaShop 1.7.0.0 RC0
PrestaShop 1.7.0.0 RC1
PrestaShop 1.7.0.0 RC2
PrestaShop 1.7.0.0 RC3
PrestaShop 1.7.0.1
PrestaShop 1.7.0.2
PrestaShop 1.7.0.3
PrestaShop 1.7.0.4
PrestaShop 1.7.0.5
PrestaShop 1.7.0.6
PrestaShop 1.7.1.0
PrestaShop 1.7.1.0 beta1
PrestaShop 1.7.1.1
PrestaShop 1.7.1.2
PrestaShop 1.7.2.0
PrestaShop 1.7.2.0 RC 1
PrestaShop 1.7.2.0-RC.1.0
PrestaShop 1.7.2.1
PrestaShop 1.7.2.2
PrestaShop 1.7.2.3
PrestaShop 1.7.2.4
PrestaShop 1.7.2.5
PrestaShop 1.7.3.0
PrestaShop 1.7.3.0 beta 1
PrestaShop 1.7.3.0 RC 1
PrestaShop 1.7.3.1
PrestaShop 1.7.3.2
PrestaShop 1.7.3.3
PrestaShop 1.7.3.4
PrestaShop 1.7.4.0
PrestaShop 1.7.4.0 beta 1
PrestaShop 1.7.4.1
PrestaShop 1.7.4.2
PrestaShop 1.7.4.3
PrestaShop 1.7.4.4
PrestaShop 1.7.5.0
PrestaShop 1.7.5.0 beta 1
PrestaShop 1.7.5.0 RC 1
PrestaShop 1.7.5.0-beta.1
PrestaShop 1.7.5.0-RC.1
PrestaShop 1.7.5.1
PrestaShop 1.7.5.2
PrestaShop 1.7.6.0
PrestaShop 1.7.6.0 beta 1
PrestaShop 1.7.6.0 RC 1
PrestaShop 1.7.6.0 RC 2
PrestaShop 1.7.6.0-beta.1
PrestaShop 1.7.6.0-RC.1
PrestaShop 1.7.6.0-RC.2
PrestaShop 1.7.6.1
PrestaShop 1.7.6.2
PrestaShop 1.7.6.3
PrestaShop 1.7.6.4
PrestaShop 1.7.6.4 1
PrestaShop 1.7.6.5
PrestaShop 1.7.6.5 1
PrestaShop 1.7.6.6
PrestaShop 1.7.6.7
PrestaShop 1.7.6.8
PrestaShop 1.7.6.9
PrestaShop 1.7.7.0
PrestaShop 1.7.7.0 beta 1
PrestaShop 1.7.7.0 beta 2
PrestaShop 1.7.7.0 RC 1
PrestaShop 1.7.7.0-beta.1
PrestaShop 1.7.7.0-beta.2
PrestaShop 1.7.7.0-RC.1
PrestaShop 1.7.7.1
PrestaShop 1.7.7.2
PrestaShop 1.7.7.3
PrestaShop 1.7.7.4
PrestaShop 1.7.7.5
PrestaShop 1.7.7.6
PrestaShop 1.7.7.7
PrestaShop 1.7.7.8
PrestaShop 1.7.7.8 1
PrestaShop 1.7.8.0
PrestaShop 1.7.8.0 beta 1
PrestaShop 1.7.8.0 1
PrestaShop 1.7.8.0 RC 1
PrestaShop 1.7.8.0-beta.1
PrestaShop 1.7.8.0-RC.1
PrestaShop 1.7.8.1
PrestaShop 1.7.8.2
PrestaShop 1.7.8.2 1
PrestaShop 1.7.8.3
PrestaShop 1.7.8.4
PrestaShop 1.7.8.5
PrestaShop 1.7.8.6
PrestaShop 1.7.8.7
PrestaShop 1.7.8.7 1
PrestaShop 1.7.8.8
PrestaShop 1.7.8.9
PrestaShop 1.7.8.10
PrestaShop 1.7.8.11
PrestaShop 8.0.0
PrestaShop 8.0.1
PrestaShop 8.0.2
PrestaShop 8.0.3
PrestaShop 8.0.4
PrestaShop 8.0.5
PrestaShop 8.1.0
PrestaShop 8.1.1
PrestaShop 8.1.2
PrestaShop 8.1.3
PrestaShop 8.1.4
PrestaShop 8.1.5
PrestaShop 8.1.6
PrestaShop 8.1.7
PrestaShop 8.2.0
PrestaShop 8.2.1
PrestaShop 8.2.2
PrestaShop 8.2.3
PrestaShop 8.2.4
PrestaShop 9.0.0
PrestaShop 9.0.0-1.0
PrestaShop 9.0.0-1.0-beta.1
PrestaShop 9.0.0-1.0-RC.1
PrestaShop 9.0.1
PrestaShop 9.0.1-1.0
PrestaShop 9.0.2
PrestaShop 9.0.2-2.0
PrestaShop 9.0.2-2.1
PrestaShop 9.0.3
PrestaShop 9.0.3-3.0
PrestaShop 9.1.0-3.0-beta.1

Presta Shop vulnerable to email enumeration

Skrevet den 1. oktober 20255. juni 2026 af i PrestaShop

An unauthenticated attacker with access to the back-office URL can manipulate the id_employee and reset_token parameters to enumerate valid back-office employee email addresses.

This vulnerability affects the following application versions:

PrestaShop 1.7.0.0
PrestaShop 1.7.0.0 alpha3
PrestaShop 1.7.0.0 alpha4
PrestaShop 1.7.0.0 beta1
PrestaShop 1.7.0.0 beta2
PrestaShop 1.7.0.0 beta3
PrestaShop 1.7.0.0 RC0
PrestaShop 1.7.0.0 RC1
PrestaShop 1.7.0.0 RC2
PrestaShop 1.7.0.0 RC3
PrestaShop 1.7.0.1
PrestaShop 1.7.0.2
PrestaShop 1.7.0.3
PrestaShop 1.7.0.4
PrestaShop 1.7.0.5
PrestaShop 1.7.0.6
PrestaShop 1.7.1.0
PrestaShop 1.7.1.0 beta1
PrestaShop 1.7.1.1
PrestaShop 1.7.1.2
PrestaShop 1.7.2.0
PrestaShop 1.7.2.0 RC 1
PrestaShop 1.7.2.0-RC.1.0
PrestaShop 1.7.2.1
PrestaShop 1.7.2.2
PrestaShop 1.7.2.3
PrestaShop 1.7.2.4
PrestaShop 1.7.2.5
PrestaShop 1.7.3.0
PrestaShop 1.7.3.0 beta 1
PrestaShop 1.7.3.0 RC 1
PrestaShop 1.7.3.1
PrestaShop 1.7.3.2
PrestaShop 1.7.3.3
PrestaShop 1.7.3.4
PrestaShop 1.7.4.0
PrestaShop 1.7.4.0 beta 1
PrestaShop 1.7.4.1
PrestaShop 1.7.4.2
PrestaShop 1.7.4.3
PrestaShop 1.7.4.4
PrestaShop 1.7.5.0
PrestaShop 1.7.5.0 beta 1
PrestaShop 1.7.5.0 RC 1
PrestaShop 1.7.5.0-beta.1
PrestaShop 1.7.5.0-RC.1
PrestaShop 1.7.5.1
PrestaShop 1.7.5.2
PrestaShop 1.7.6.0
PrestaShop 1.7.6.0 beta 1
PrestaShop 1.7.6.0 RC 1
PrestaShop 1.7.6.0 RC 2
PrestaShop 1.7.6.0-beta.1
PrestaShop 1.7.6.0-RC.1
PrestaShop 1.7.6.0-RC.2
PrestaShop 1.7.6.1
PrestaShop 1.7.6.2
PrestaShop 1.7.6.3
PrestaShop 1.7.6.4
PrestaShop 1.7.6.4 1
PrestaShop 1.7.6.5
PrestaShop 1.7.6.5 1
PrestaShop 1.7.6.6
PrestaShop 1.7.6.7
PrestaShop 1.7.6.8
PrestaShop 1.7.6.9
PrestaShop 1.7.7.0
PrestaShop 1.7.7.0 beta 1
PrestaShop 1.7.7.0 beta 2
PrestaShop 1.7.7.0 RC 1
PrestaShop 1.7.7.0-beta.1
PrestaShop 1.7.7.0-beta.2
PrestaShop 1.7.7.0-RC.1
PrestaShop 1.7.7.1
PrestaShop 1.7.7.2
PrestaShop 1.7.7.3
PrestaShop 1.7.7.4
PrestaShop 1.7.7.5
PrestaShop 1.7.7.6
PrestaShop 1.7.7.7
PrestaShop 1.7.7.8
PrestaShop 1.7.7.8 1
PrestaShop 1.7.8.0
PrestaShop 1.7.8.0 beta 1
PrestaShop 1.7.8.0 1
PrestaShop 1.7.8.0 RC 1
PrestaShop 1.7.8.0-beta.1
PrestaShop 1.7.8.0-RC.1
PrestaShop 1.7.8.1
PrestaShop 1.7.8.2
PrestaShop 1.7.8.2 1
PrestaShop 1.7.8.3
PrestaShop 1.7.8.4
PrestaShop 1.7.8.5
PrestaShop 1.7.8.6
PrestaShop 1.7.8.7
PrestaShop 1.7.8.7 1
PrestaShop 1.7.8.8
PrestaShop 1.7.8.9
PrestaShop 1.7.8.10
PrestaShop 1.7.8.11
PrestaShop 8.0.0
PrestaShop 8.0.1
PrestaShop 8.0.2
PrestaShop 8.0.3
PrestaShop 8.0.4
PrestaShop 8.0.5
PrestaShop 8.1.0
PrestaShop 8.1.1
PrestaShop 8.1.2
PrestaShop 8.1.3
PrestaShop 8.1.4
PrestaShop 8.1.5
PrestaShop 8.1.6
PrestaShop 8.1.7
PrestaShop 8.2.0
PrestaShop 8.2.1
PrestaShop 8.2.2

Anonymous customer can download other customers’s invoices

Skrevet den 28. maj 202420. november 2024 af i PrestaShop

Since PrestaShop 8.1.5, any invoice can be downloaded from front-office in anonymous mode, by supplying a random secure_key parameter in the url. CVE-2024-34717

This vulnerability affects the following application versions:

PrestaShop 8.1.5

Path disclosure in JavaScript variable

Skrevet den 15. marts 202418. oktober 2025 af i PrestaShop

Fixes theme_dir tpl variable. CVE-2024-26129

This vulnerability affects the following application versions:

PrestaShop 8.1.0
PrestaShop 8.1.1
PrestaShop 8.1.2
PrestaShop 8.1.3

Prevent unauthorized employee to get all installed modules

Skrevet den 12. februar 2024 af i PrestaShop

Specifically prevents employees without any access rights from listing all installed modules, ensuring that only those with the ‘view’ access permission can execute the related functionality.

This vulnerability affects the following application versions:

PrestaShop 1.6.1.0
PrestaShop 1.6.1.0 RC4
PrestaShop 1.6.1.0 RC5
PrestaShop 1.6.1.1
PrestaShop 1.6.1.1 RC1
PrestaShop 1.6.1.1 RC2
PrestaShop 1.6.1.2
PrestaShop 1.6.1.2 RC1
PrestaShop 1.6.1.2 RC2
PrestaShop 1.6.1.2 RC3
PrestaShop 1.6.1.2 RC4
PrestaShop 1.6.1.3
PrestaShop 1.6.1.3 RC1
PrestaShop 1.6.1.4
PrestaShop 1.6.1.5
PrestaShop 1.6.1.6
PrestaShop 1.6.1.7
PrestaShop 1.6.1.8
PrestaShop 1.6.1.9
PrestaShop 1.6.1.10
PrestaShop 1.6.1.11
PrestaShop 1.6.1.11 beta 1
PrestaShop 1.6.1.11-beta.1.0
PrestaShop 1.6.1.12
PrestaShop 1.6.1.13
PrestaShop 1.6.1.14
PrestaShop 1.6.1.15
PrestaShop 1.6.1.16
PrestaShop 1.6.1.17
PrestaShop 1.6.1.18
PrestaShop 1.6.1.19
PrestaShop 1.6.1.20
PrestaShop 1.6.1.21
PrestaShop 1.6.1.22
PrestaShop 1.6.1.23
PrestaShop 1.6.1.24
PrestaShop 1.7.0.0
PrestaShop 1.7.0.0 alpha3
PrestaShop 1.7.0.0 alpha4
PrestaShop 1.7.0.0 beta1
PrestaShop 1.7.0.0 beta2
PrestaShop 1.7.0.0 beta3
PrestaShop 1.7.0.0 RC0
PrestaShop 1.7.0.0 RC1
PrestaShop 1.7.0.0 RC2
PrestaShop 1.7.0.0 RC3
PrestaShop 1.7.0.1
PrestaShop 1.7.0.2
PrestaShop 1.7.0.3
PrestaShop 1.7.0.4
PrestaShop 1.7.0.5
PrestaShop 1.7.0.6
PrestaShop 1.7.1.0
PrestaShop 1.7.1.0 beta1
PrestaShop 1.7.1.1
PrestaShop 1.7.1.2
PrestaShop 1.7.2.0
PrestaShop 1.7.2.0 RC 1
PrestaShop 1.7.2.0-RC.1.0
PrestaShop 1.7.2.1
PrestaShop 1.7.2.2
PrestaShop 1.7.2.3
PrestaShop 1.7.2.4
PrestaShop 1.7.2.5
PrestaShop 1.7.3.0
PrestaShop 1.7.3.0 beta 1
PrestaShop 1.7.3.0 RC 1
PrestaShop 1.7.3.1
PrestaShop 1.7.3.2
PrestaShop 1.7.3.3
PrestaShop 1.7.3.4
PrestaShop 1.7.4.0
PrestaShop 1.7.4.0 beta 1
PrestaShop 1.7.4.1
PrestaShop 1.7.4.2
PrestaShop 1.7.4.3
PrestaShop 1.7.4.4
PrestaShop 1.7.5.0
PrestaShop 1.7.5.0 beta 1
PrestaShop 1.7.5.0 RC 1
PrestaShop 1.7.5.0-beta.1
PrestaShop 1.7.5.0-RC.1
PrestaShop 1.7.5.1
PrestaShop 1.7.5.2
PrestaShop 1.7.6.0
PrestaShop 1.7.6.0 beta 1
PrestaShop 1.7.6.0 RC 1
PrestaShop 1.7.6.0 RC 2
PrestaShop 1.7.6.0-beta.1
PrestaShop 1.7.6.0-RC.1
PrestaShop 1.7.6.0-RC.2
PrestaShop 1.7.6.1
PrestaShop 1.7.6.2
PrestaShop 1.7.6.3
PrestaShop 1.7.6.4
PrestaShop 1.7.6.4 1
PrestaShop 1.7.6.5
PrestaShop 1.7.6.5 1
PrestaShop 1.7.6.6
PrestaShop 1.7.6.7
PrestaShop 1.7.6.8
PrestaShop 1.7.6.9
PrestaShop 1.7.7.0
PrestaShop 1.7.7.0 beta 1
PrestaShop 1.7.7.0 beta 2
PrestaShop 1.7.7.0 RC 1
PrestaShop 1.7.7.0-beta.1
PrestaShop 1.7.7.0-beta.2
PrestaShop 1.7.7.0-RC.1
PrestaShop 1.7.7.1
PrestaShop 1.7.7.2
PrestaShop 1.7.7.3
PrestaShop 1.7.7.4
PrestaShop 1.7.7.5
PrestaShop 1.7.7.6
PrestaShop 1.7.7.7
PrestaShop 1.7.7.8
PrestaShop 1.7.7.8 1
PrestaShop 1.7.8.0
PrestaShop 1.7.8.0 beta 1
PrestaShop 1.7.8.0 1
PrestaShop 1.7.8.0 RC 1
PrestaShop 1.7.8.0-beta.1
PrestaShop 1.7.8.0-RC.1
PrestaShop 1.7.8.1
PrestaShop 1.7.8.2
PrestaShop 1.7.8.2 1
PrestaShop 1.7.8.3
PrestaShop 1.7.8.4
PrestaShop 1.7.8.5
PrestaShop 1.7.8.6
PrestaShop 1.7.8.7
PrestaShop 1.7.8.7 1
PrestaShop 1.7.8.8
PrestaShop 1.7.8.9
PrestaShop 1.7.8.10
PrestaShop 1.7.8.11
PrestaShop 8.0.0
PrestaShop 8.0.1
PrestaShop 8.0.2
PrestaShop 8.0.3
PrestaShop 8.0.4
PrestaShop 8.0.5
PrestaShop 8.1.0
PrestaShop 8.1.1

Some event attributes are not detected by the isCleanHTML method

Skrevet den 25. januar 20245. juni 2026 af i PrestaShop

Some modules using the isCleanHTML method could be vulnerable to xss.

This vulnerability affects the following application versions:

PrestaShop 1.6.0.1
PrestaShop 1.6.0.1 alpha 1
PrestaShop 1.6.0.2
PrestaShop 1.6.0.2 alpha 2
PrestaShop 1.6.0.3
PrestaShop 1.6.0.3 beta 1
PrestaShop 1.6.0.4
PrestaShop 1.6.0.4 RC1
PrestaShop 1.6.0.5
PrestaShop 1.6.0.6
PrestaShop 1.6.0.7
PrestaShop 1.6.0.8
PrestaShop 1.6.0.9
PrestaShop 1.6.0.10
PrestaShop 1.6.0.11
PrestaShop 1.6.0.12
PrestaShop 1.6.0.13
PrestaShop 1.6.0.14
PrestaShop 1.6.1.0
PrestaShop 1.6.1.0 RC4
PrestaShop 1.6.1.0 RC5
PrestaShop 1.6.1.1
PrestaShop 1.6.1.1 RC1
PrestaShop 1.6.1.1 RC2
PrestaShop 1.6.1.2
PrestaShop 1.6.1.2 RC1
PrestaShop 1.6.1.2 RC2
PrestaShop 1.6.1.2 RC3
PrestaShop 1.6.1.2 RC4
PrestaShop 1.6.1.3
PrestaShop 1.6.1.3 RC1
PrestaShop 1.6.1.4
PrestaShop 1.6.1.5
PrestaShop 1.6.1.6
PrestaShop 1.6.1.7
PrestaShop 1.6.1.8
PrestaShop 1.6.1.9
PrestaShop 1.6.1.10
PrestaShop 1.6.1.11
PrestaShop 1.6.1.11 beta 1
PrestaShop 1.6.1.11-beta.1.0
PrestaShop 1.6.1.12
PrestaShop 1.6.1.13
PrestaShop 1.6.1.14
PrestaShop 1.6.1.15
PrestaShop 1.6.1.16
PrestaShop 1.6.1.17
PrestaShop 1.6.1.18
PrestaShop 1.6.1.19
PrestaShop 1.6.1.20
PrestaShop 1.6.1.21
PrestaShop 1.6.1.22
PrestaShop 1.6.1.23
PrestaShop 1.6.1.24
PrestaShop 1.7.0.0
PrestaShop 1.7.0.0 alpha3
PrestaShop 1.7.0.0 alpha4
PrestaShop 1.7.0.0 beta1
PrestaShop 1.7.0.0 beta2
PrestaShop 1.7.0.0 beta3
PrestaShop 1.7.0.0 RC0
PrestaShop 1.7.0.0 RC1
PrestaShop 1.7.0.0 RC2
PrestaShop 1.7.0.0 RC3
PrestaShop 1.7.0.1
PrestaShop 1.7.0.2
PrestaShop 1.7.0.3
PrestaShop 1.7.0.4
PrestaShop 1.7.0.5
PrestaShop 1.7.0.6
PrestaShop 1.7.1.0
PrestaShop 1.7.1.0 beta1
PrestaShop 1.7.1.1
PrestaShop 1.7.1.2
PrestaShop 1.7.2.0
PrestaShop 1.7.2.0 RC 1
PrestaShop 1.7.2.0-RC.1.0
PrestaShop 1.7.2.1
PrestaShop 1.7.2.2
PrestaShop 1.7.2.3
PrestaShop 1.7.2.4
PrestaShop 1.7.2.5
PrestaShop 1.7.3.0
PrestaShop 1.7.3.0 beta 1
PrestaShop 1.7.3.0 RC 1
PrestaShop 1.7.3.1
PrestaShop 1.7.3.2
PrestaShop 1.7.3.3
PrestaShop 1.7.3.4
PrestaShop 1.7.4.0
PrestaShop 1.7.4.0 beta 1
PrestaShop 1.7.4.1
PrestaShop 1.7.4.2
PrestaShop 1.7.4.3
PrestaShop 1.7.4.4
PrestaShop 1.7.5.0
PrestaShop 1.7.5.0 beta 1
PrestaShop 1.7.5.0 RC 1
PrestaShop 1.7.5.0-beta.1
PrestaShop 1.7.5.0-RC.1
PrestaShop 1.7.5.1
PrestaShop 1.7.5.2
PrestaShop 1.7.6.0
PrestaShop 1.7.6.0 beta 1
PrestaShop 1.7.6.0 RC 1
PrestaShop 1.7.6.0 RC 2
PrestaShop 1.7.6.0-beta.1
PrestaShop 1.7.6.0-RC.1
PrestaShop 1.7.6.0-RC.2
PrestaShop 1.7.6.1
PrestaShop 1.7.6.2
PrestaShop 1.7.6.3
PrestaShop 1.7.6.4
PrestaShop 1.7.6.4 1
PrestaShop 1.7.6.5
PrestaShop 1.7.6.5 1
PrestaShop 1.7.6.6
PrestaShop 1.7.6.7
PrestaShop 1.7.6.8
PrestaShop 1.7.6.9
PrestaShop 1.7.7.0
PrestaShop 1.7.7.0 beta 1
PrestaShop 1.7.7.0 beta 2
PrestaShop 1.7.7.0 RC 1
PrestaShop 1.7.7.0-beta.1
PrestaShop 1.7.7.0-beta.2
PrestaShop 1.7.7.0-RC.1
PrestaShop 1.7.7.1
PrestaShop 1.7.7.2
PrestaShop 1.7.7.3
PrestaShop 1.7.7.4
PrestaShop 1.7.7.5
PrestaShop 1.7.7.6
PrestaShop 1.7.7.7
PrestaShop 1.7.7.8
PrestaShop 1.7.7.8 1
PrestaShop 1.7.8.0
PrestaShop 1.7.8.0 beta 1
PrestaShop 1.7.8.0 1
PrestaShop 1.7.8.0 RC 1
PrestaShop 1.7.8.0-beta.1
PrestaShop 1.7.8.0-RC.1
PrestaShop 1.7.8.1
PrestaShop 1.7.8.2
PrestaShop 1.7.8.2 1
PrestaShop 1.7.8.3
PrestaShop 1.7.8.4
PrestaShop 1.7.8.5
PrestaShop 1.7.8.6
PrestaShop 1.7.8.7
PrestaShop 1.7.8.7 1
PrestaShop 1.7.8.8
PrestaShop 1.7.8.9
PrestaShop 1.7.8.10
PrestaShop 8.0.0
PrestaShop 8.0.1
PrestaShop 8.0.2
PrestaShop 8.0.3
PrestaShop 8.0.4
PrestaShop 8.0.5
PrestaShop 8.1.0
PrestaShop 8.1.1
PrestaShop 8.1.2

Stored XSS in DB

Skrevet den 25. januar 20245. juni 2026 af i PrestaShop

XSS can be stored in DB from “add a message form” in order detail page (FO).

This vulnerability affects the following application versions:

PrestaShop 1.6.0.1
PrestaShop 1.6.0.1 alpha 1
PrestaShop 1.6.0.2
PrestaShop 1.6.0.2 alpha 2
PrestaShop 1.6.0.3
PrestaShop 1.6.0.3 beta 1
PrestaShop 1.6.0.4
PrestaShop 1.6.0.4 RC1
PrestaShop 1.6.0.5
PrestaShop 1.6.0.6
PrestaShop 1.6.0.7
PrestaShop 1.6.0.8
PrestaShop 1.6.0.9
PrestaShop 1.6.0.10
PrestaShop 1.6.0.11
PrestaShop 1.6.0.12
PrestaShop 1.6.0.13
PrestaShop 1.6.0.14
PrestaShop 1.6.1.0
PrestaShop 1.6.1.0 RC4
PrestaShop 1.6.1.0 RC5
PrestaShop 1.6.1.1
PrestaShop 1.6.1.1 RC1
PrestaShop 1.6.1.1 RC2
PrestaShop 1.6.1.2
PrestaShop 1.6.1.2 RC1
PrestaShop 1.6.1.2 RC2
PrestaShop 1.6.1.2 RC3
PrestaShop 1.6.1.2 RC4
PrestaShop 1.6.1.3
PrestaShop 1.6.1.3 RC1
PrestaShop 1.6.1.4
PrestaShop 1.6.1.5
PrestaShop 1.6.1.6
PrestaShop 1.6.1.7
PrestaShop 1.6.1.8
PrestaShop 1.6.1.9
PrestaShop 1.6.1.10
PrestaShop 1.6.1.11
PrestaShop 1.6.1.11 beta 1
PrestaShop 1.6.1.11-beta.1.0
PrestaShop 1.6.1.12
PrestaShop 1.6.1.13
PrestaShop 1.6.1.14
PrestaShop 1.6.1.15
PrestaShop 1.6.1.16
PrestaShop 1.6.1.17
PrestaShop 1.6.1.18
PrestaShop 1.6.1.19
PrestaShop 1.6.1.20
PrestaShop 1.6.1.21
PrestaShop 1.6.1.22
PrestaShop 1.6.1.23
PrestaShop 1.6.1.24
PrestaShop 1.7.0.0
PrestaShop 1.7.0.0 alpha3
PrestaShop 1.7.0.0 alpha4
PrestaShop 1.7.0.0 beta1
PrestaShop 1.7.0.0 beta2
PrestaShop 1.7.0.0 beta3
PrestaShop 1.7.0.0 RC0
PrestaShop 1.7.0.0 RC1
PrestaShop 1.7.0.0 RC2
PrestaShop 1.7.0.0 RC3
PrestaShop 1.7.0.1
PrestaShop 1.7.0.2
PrestaShop 1.7.0.3
PrestaShop 1.7.0.4
PrestaShop 1.7.0.5
PrestaShop 1.7.0.6
PrestaShop 1.7.1.0
PrestaShop 1.7.1.0 beta1
PrestaShop 1.7.1.1
PrestaShop 1.7.1.2
PrestaShop 1.7.2.0
PrestaShop 1.7.2.0 RC 1
PrestaShop 1.7.2.0-RC.1.0
PrestaShop 1.7.2.1
PrestaShop 1.7.2.2
PrestaShop 1.7.2.3
PrestaShop 1.7.2.4
PrestaShop 1.7.2.5
PrestaShop 1.7.3.0
PrestaShop 1.7.3.0 beta 1
PrestaShop 1.7.3.0 RC 1
PrestaShop 1.7.3.1
PrestaShop 1.7.3.2
PrestaShop 1.7.3.3
PrestaShop 1.7.3.4
PrestaShop 1.7.4.0
PrestaShop 1.7.4.0 beta 1
PrestaShop 1.7.4.1
PrestaShop 1.7.4.2
PrestaShop 1.7.4.3
PrestaShop 1.7.4.4
PrestaShop 1.7.5.0
PrestaShop 1.7.5.0 beta 1
PrestaShop 1.7.5.0 RC 1
PrestaShop 1.7.5.0-beta.1
PrestaShop 1.7.5.0-RC.1
PrestaShop 1.7.5.1
PrestaShop 1.7.5.2
PrestaShop 1.7.6.0
PrestaShop 1.7.6.0 beta 1
PrestaShop 1.7.6.0 RC 1
PrestaShop 1.7.6.0 RC 2
PrestaShop 1.7.6.0-beta.1
PrestaShop 1.7.6.0-RC.1
PrestaShop 1.7.6.0-RC.2
PrestaShop 1.7.6.1
PrestaShop 1.7.6.2
PrestaShop 1.7.6.3
PrestaShop 1.7.6.4
PrestaShop 1.7.6.4 1
PrestaShop 1.7.6.5
PrestaShop 1.7.6.5 1
PrestaShop 1.7.6.6
PrestaShop 1.7.6.7
PrestaShop 1.7.6.8
PrestaShop 1.7.6.9
PrestaShop 1.7.7.0
PrestaShop 1.7.7.0 beta 1
PrestaShop 1.7.7.0 beta 2
PrestaShop 1.7.7.0 RC 1
PrestaShop 1.7.7.0-beta.1
PrestaShop 1.7.7.0-beta.2
PrestaShop 1.7.7.0-RC.1
PrestaShop 1.7.7.1
PrestaShop 1.7.7.2
PrestaShop 1.7.7.3
PrestaShop 1.7.7.4
PrestaShop 1.7.7.5
PrestaShop 1.7.7.6
PrestaShop 1.7.7.7
PrestaShop 1.7.7.8
PrestaShop 1.7.7.8 1
PrestaShop 1.7.8.0
PrestaShop 1.7.8.0 beta 1
PrestaShop 1.7.8.0 1
PrestaShop 1.7.8.0 RC 1
PrestaShop 1.7.8.0-beta.1
PrestaShop 1.7.8.0-RC.1
PrestaShop 1.7.8.1
PrestaShop 1.7.8.2
PrestaShop 1.7.8.2 1
PrestaShop 1.7.8.3
PrestaShop 1.7.8.4
PrestaShop 1.7.8.5
PrestaShop 1.7.8.6
PrestaShop 1.7.8.7
PrestaShop 1.7.8.7 1
PrestaShop 1.7.8.8
PrestaShop 1.7.8.9
PrestaShop 1.7.8.10
PrestaShop 1.7.8.11
PrestaShop 8.0.0
PrestaShop 8.0.1
PrestaShop 8.0.2
PrestaShop 8.0.3
PrestaShop 8.0.4
PrestaShop 8.0.5
PrestaShop 8.1.0
PrestaShop 8.1.1
PrestaShop 8.1.2

Improper Privilege Management

Skrevet den 20. december 20235. juni 2026 af i PrestaShop

Any module can be disabled or uninstalled from back office, even with low user right.

CVE: CVE-2023-43663

This vulnerability affects the following application versions:

PrestaShop 1.6.0.1
PrestaShop 1.6.0.1 alpha 1
PrestaShop 1.6.0.2
PrestaShop 1.6.0.2 alpha 2
PrestaShop 1.6.0.3
PrestaShop 1.6.0.3 beta 1
PrestaShop 1.6.0.4
PrestaShop 1.6.0.4 RC1
PrestaShop 1.6.0.5
PrestaShop 1.6.0.6
PrestaShop 1.6.0.7
PrestaShop 1.6.0.8
PrestaShop 1.6.0.9
PrestaShop 1.6.0.10
PrestaShop 1.6.0.11
PrestaShop 1.6.0.12
PrestaShop 1.6.0.13
PrestaShop 1.6.0.14
PrestaShop 1.6.1.0
PrestaShop 1.6.1.0 RC4
PrestaShop 1.6.1.0 RC5
PrestaShop 1.6.1.1
PrestaShop 1.6.1.1 RC1
PrestaShop 1.6.1.1 RC2
PrestaShop 1.6.1.2
PrestaShop 1.6.1.2 RC1
PrestaShop 1.6.1.2 RC2
PrestaShop 1.6.1.2 RC3
PrestaShop 1.6.1.2 RC4
PrestaShop 1.6.1.3
PrestaShop 1.6.1.3 RC1
PrestaShop 1.6.1.4
PrestaShop 1.6.1.5
PrestaShop 1.6.1.6
PrestaShop 1.6.1.7
PrestaShop 1.6.1.8
PrestaShop 1.6.1.9
PrestaShop 1.6.1.10
PrestaShop 1.6.1.11
PrestaShop 1.6.1.11 beta 1
PrestaShop 1.6.1.11-beta.1.0
PrestaShop 1.6.1.12
PrestaShop 1.6.1.13
PrestaShop 1.6.1.14
PrestaShop 1.6.1.15
PrestaShop 1.6.1.16
PrestaShop 1.6.1.17
PrestaShop 1.6.1.18
PrestaShop 1.6.1.19
PrestaShop 1.6.1.20
PrestaShop 1.6.1.21
PrestaShop 1.6.1.22
PrestaShop 1.6.1.23
PrestaShop 1.6.1.24
PrestaShop 1.7.0.0
PrestaShop 1.7.0.0 alpha3
PrestaShop 1.7.0.0 alpha4
PrestaShop 1.7.0.0 beta1
PrestaShop 1.7.0.0 beta2
PrestaShop 1.7.0.0 beta3
PrestaShop 1.7.0.0 RC0
PrestaShop 1.7.0.0 RC1
PrestaShop 1.7.0.0 RC2
PrestaShop 1.7.0.0 RC3
PrestaShop 1.7.0.1
PrestaShop 1.7.0.2
PrestaShop 1.7.0.3
PrestaShop 1.7.0.4
PrestaShop 1.7.0.5
PrestaShop 1.7.0.6
PrestaShop 1.7.1.0
PrestaShop 1.7.1.0 beta1
PrestaShop 1.7.1.1
PrestaShop 1.7.1.2
PrestaShop 1.7.2.0
PrestaShop 1.7.2.0 RC 1
PrestaShop 1.7.2.0-RC.1.0
PrestaShop 1.7.2.1
PrestaShop 1.7.2.2
PrestaShop 1.7.2.3
PrestaShop 1.7.2.4
PrestaShop 1.7.2.5
PrestaShop 1.7.3.0
PrestaShop 1.7.3.0 beta 1
PrestaShop 1.7.3.0 RC 1
PrestaShop 1.7.3.1
PrestaShop 1.7.3.2
PrestaShop 1.7.3.3
PrestaShop 1.7.3.4
PrestaShop 1.7.4.0
PrestaShop 1.7.4.0 beta 1
PrestaShop 1.7.4.1
PrestaShop 1.7.4.2
PrestaShop 1.7.4.3
PrestaShop 1.7.4.4
PrestaShop 1.7.5.0
PrestaShop 1.7.5.0 beta 1
PrestaShop 1.7.5.0 RC 1
PrestaShop 1.7.5.0-beta.1
PrestaShop 1.7.5.0-RC.1
PrestaShop 1.7.5.1
PrestaShop 1.7.5.2
PrestaShop 1.7.6.0
PrestaShop 1.7.6.0 beta 1
PrestaShop 1.7.6.0 RC 1
PrestaShop 1.7.6.0 RC 2
PrestaShop 1.7.6.0-beta.1
PrestaShop 1.7.6.0-RC.1
PrestaShop 1.7.6.0-RC.2
PrestaShop 1.7.6.1
PrestaShop 1.7.6.2
PrestaShop 1.7.6.3
PrestaShop 1.7.6.4
PrestaShop 1.7.6.4 1
PrestaShop 1.7.6.5
PrestaShop 1.7.6.5 1
PrestaShop 1.7.6.6
PrestaShop 1.7.6.7
PrestaShop 1.7.6.8
PrestaShop 1.7.6.9
PrestaShop 1.7.7.0
PrestaShop 1.7.7.0 beta 1
PrestaShop 1.7.7.0 beta 2
PrestaShop 1.7.7.0 RC 1
PrestaShop 1.7.7.0-beta.1
PrestaShop 1.7.7.0-beta.2
PrestaShop 1.7.7.0-RC.1
PrestaShop 1.7.7.1
PrestaShop 1.7.7.2
PrestaShop 1.7.7.3
PrestaShop 1.7.7.4
PrestaShop 1.7.7.5
PrestaShop 1.7.7.6
PrestaShop 1.7.7.7
PrestaShop 1.7.7.8
PrestaShop 1.7.7.8 1
PrestaShop 1.7.8.0
PrestaShop 1.7.8.0 beta 1
PrestaShop 1.7.8.0 1
PrestaShop 1.7.8.0 RC 1
PrestaShop 1.7.8.0-beta.1
PrestaShop 1.7.8.0-RC.1
PrestaShop 1.7.8.1
PrestaShop 1.7.8.2
PrestaShop 1.7.8.2 1
PrestaShop 1.7.8.3
PrestaShop 1.7.8.4
PrestaShop 1.7.8.5
PrestaShop 1.7.8.6
PrestaShop 1.7.8.7
PrestaShop 1.7.8.7 1
PrestaShop 1.7.8.8
PrestaShop 1.7.8.9
PrestaShop 1.7.8.10
PrestaShop 1.7.8.11
PrestaShop 8.0.0
PrestaShop 8.0.1
PrestaShop 8.0.2
PrestaShop 8.0.3
PrestaShop 8.0.4
PrestaShop 8.0.5
PrestaShop 8.1.0
PrestaShop 8.1.1

boolean SQL injection possible in search product in BO

Skrevet den 29. august 202320. november 2024 af i PrestaShop

An SQL injection is possible in product search field, in BO’s product page.

This vulnerability affects the following application versions:

PrestaShop 8.0.0
PrestaShop 8.0.1
PrestaShop 8.0.2
PrestaShop 8.0.3
PrestaShop 8.0.4
PrestaShop 8.0.5
PrestaShop 8.1.0

path traversal: file deletion

Skrevet den 22. august 20235. juni 2026 af i PrestaShop

In the back office, files can be compromised using path traversal by replaying the import file deletion query with a specified file path, using traversal path.

This vulnerability affects the following application versions:

PrestaShop 1.7.4.0
PrestaShop 1.7.4.0 beta 1
PrestaShop 1.7.4.1
PrestaShop 1.7.4.2
PrestaShop 1.7.4.3
PrestaShop 1.7.4.4
PrestaShop 1.7.5.0
PrestaShop 1.7.5.0 beta 1
PrestaShop 1.7.5.0 RC 1
PrestaShop 1.7.5.0-beta.1
PrestaShop 1.7.5.0-RC.1
PrestaShop 1.7.5.1
PrestaShop 1.7.5.2
PrestaShop 1.7.6.0
PrestaShop 1.7.6.0 beta 1
PrestaShop 1.7.6.0 RC 1
PrestaShop 1.7.6.0 RC 2
PrestaShop 1.7.6.0-beta.1
PrestaShop 1.7.6.0-RC.1
PrestaShop 1.7.6.0-RC.2
PrestaShop 1.7.6.1
PrestaShop 1.7.6.2
PrestaShop 1.7.6.3
PrestaShop 1.7.6.4
PrestaShop 1.7.6.4 1
PrestaShop 1.7.6.5
PrestaShop 1.7.6.5 1
PrestaShop 1.7.6.6
PrestaShop 1.7.6.7
PrestaShop 1.7.6.8
PrestaShop 1.7.6.9
PrestaShop 1.7.7.0
PrestaShop 1.7.7.0 beta 1
PrestaShop 1.7.7.0 beta 2
PrestaShop 1.7.7.0 RC 1
PrestaShop 1.7.7.0-beta.1
PrestaShop 1.7.7.0-beta.2
PrestaShop 1.7.7.0-RC.1
PrestaShop 1.7.7.1
PrestaShop 1.7.7.2
PrestaShop 1.7.7.3
PrestaShop 1.7.7.4
PrestaShop 1.7.7.5
PrestaShop 1.7.7.6
PrestaShop 1.7.7.7
PrestaShop 1.7.7.8
PrestaShop 1.7.7.8 1
PrestaShop 1.7.8.0
PrestaShop 1.7.8.0 beta 1
PrestaShop 1.7.8.0 1
PrestaShop 1.7.8.0 RC 1
PrestaShop 1.7.8.0-beta.1
PrestaShop 1.7.8.0-RC.1
PrestaShop 1.7.8.1
PrestaShop 1.7.8.2
PrestaShop 1.7.8.2 1
PrestaShop 1.7.8.3
PrestaShop 1.7.8.4
PrestaShop 1.7.8.5
PrestaShop 1.7.8.6
PrestaShop 1.7.8.7
PrestaShop 1.7.8.7 1
PrestaShop 1.7.8.8
PrestaShop 1.7.8.9
PrestaShop 1.7.8.10
PrestaShop 1.7.8.11
PrestaShop 8.0.0
PrestaShop 8.0.1
PrestaShop 8.0.2
PrestaShop 8.0.3
PrestaShop 8.0.4
PrestaShop 8.0.5
PrestaShop 8.1.0

Reading a file through path traversal

Skrevet den 22. august 20235. juni 2026 af i PrestaShop

displayAjaxEmailHTML method can be used to read any file on the server, potentially even outside of the project if the server is not correctly configured.

This vulnerability affects the following application versions:

PrestaShop 1.7.1.0
PrestaShop 1.7.1.0 beta1
PrestaShop 1.7.1.1
PrestaShop 1.7.1.2
PrestaShop 1.7.2.0
PrestaShop 1.7.2.0 RC 1
PrestaShop 1.7.2.0-RC.1.0
PrestaShop 1.7.2.1
PrestaShop 1.7.2.2
PrestaShop 1.7.2.3
PrestaShop 1.7.2.4
PrestaShop 1.7.2.5
PrestaShop 1.7.3.0
PrestaShop 1.7.3.0 beta 1
PrestaShop 1.7.3.0 RC 1
PrestaShop 1.7.3.1
PrestaShop 1.7.3.2
PrestaShop 1.7.3.3
PrestaShop 1.7.3.4
PrestaShop 1.7.4.0
PrestaShop 1.7.4.0 beta 1
PrestaShop 1.7.4.1
PrestaShop 1.7.4.2
PrestaShop 1.7.4.3
PrestaShop 1.7.4.4
PrestaShop 1.7.5.0
PrestaShop 1.7.5.0 beta 1
PrestaShop 1.7.5.0 RC 1
PrestaShop 1.7.5.0-beta.1
PrestaShop 1.7.5.0-RC.1
PrestaShop 1.7.5.1
PrestaShop 1.7.5.2
PrestaShop 1.7.6.0
PrestaShop 1.7.6.0 beta 1
PrestaShop 1.7.6.0 RC 1
PrestaShop 1.7.6.0 RC 2
PrestaShop 1.7.6.0-beta.1
PrestaShop 1.7.6.0-RC.1
PrestaShop 1.7.6.0-RC.2
PrestaShop 1.7.6.1
PrestaShop 1.7.6.2
PrestaShop 1.7.6.3
PrestaShop 1.7.6.4
PrestaShop 1.7.6.4 1
PrestaShop 1.7.6.5
PrestaShop 1.7.6.5 1
PrestaShop 1.7.6.6
PrestaShop 1.7.6.7
PrestaShop 1.7.6.8
PrestaShop 1.7.6.9
PrestaShop 1.7.7.0
PrestaShop 1.7.7.0 beta 1
PrestaShop 1.7.7.0 beta 2
PrestaShop 1.7.7.0 RC 1
PrestaShop 1.7.7.0-beta.1
PrestaShop 1.7.7.0-beta.2
PrestaShop 1.7.7.0-RC.1
PrestaShop 1.7.7.1
PrestaShop 1.7.7.2
PrestaShop 1.7.7.3
PrestaShop 1.7.7.4
PrestaShop 1.7.7.5
PrestaShop 1.7.7.6
PrestaShop 1.7.7.7
PrestaShop 1.7.7.8
PrestaShop 1.7.7.8 1
PrestaShop 1.7.8.0
PrestaShop 1.7.8.0 beta 1
PrestaShop 1.7.8.0 1
PrestaShop 1.7.8.0 RC 1
PrestaShop 1.7.8.0-beta.1
PrestaShop 1.7.8.0-RC.1
PrestaShop 1.7.8.1
PrestaShop 1.7.8.2
PrestaShop 1.7.8.2 1
PrestaShop 1.7.8.3
PrestaShop 1.7.8.4
PrestaShop 1.7.8.5
PrestaShop 1.7.8.6
PrestaShop 1.7.8.7
PrestaShop 1.7.8.7 1
PrestaShop 1.7.8.8
PrestaShop 1.7.8.9
PrestaShop 1.7.8.10
PrestaShop 1.7.8.11
PrestaShop 8.0.0
PrestaShop 8.0.1
PrestaShop 8.0.2
PrestaShop 8.0.3
PrestaShop 8.0.4
PrestaShop 8.0.5
PrestaShop 8.1.0

File deletion via attachment API

Skrevet den 15. august 20235. juni 2026 af i PrestaShop

It is possible to delete a file from the server by using the Attachments controller and the Attachments API.

This vulnerability affects the following application versions:

PrestaShop 1.7.0.0
PrestaShop 1.7.0.0 alpha3
PrestaShop 1.7.0.0 alpha4
PrestaShop 1.7.0.0 beta1
PrestaShop 1.7.0.0 beta2
PrestaShop 1.7.0.0 beta3
PrestaShop 1.7.0.0 RC0
PrestaShop 1.7.0.0 RC1
PrestaShop 1.7.0.0 RC2
PrestaShop 1.7.0.0 RC3
PrestaShop 1.7.0.1
PrestaShop 1.7.0.2
PrestaShop 1.7.0.3
PrestaShop 1.7.0.4
PrestaShop 1.7.0.5
PrestaShop 1.7.0.6
PrestaShop 1.7.1.0
PrestaShop 1.7.1.0 beta1
PrestaShop 1.7.1.1
PrestaShop 1.7.1.2
PrestaShop 1.7.2.0
PrestaShop 1.7.2.0 RC 1
PrestaShop 1.7.2.0-RC.1.0
PrestaShop 1.7.2.1
PrestaShop 1.7.2.2
PrestaShop 1.7.2.3
PrestaShop 1.7.2.4
PrestaShop 1.7.2.5
PrestaShop 1.7.3.0
PrestaShop 1.7.3.0 beta 1
PrestaShop 1.7.3.0 RC 1
PrestaShop 1.7.3.1
PrestaShop 1.7.3.2
PrestaShop 1.7.3.3
PrestaShop 1.7.3.4
PrestaShop 1.7.4.0
PrestaShop 1.7.4.0 beta 1
PrestaShop 1.7.4.1
PrestaShop 1.7.4.2
PrestaShop 1.7.4.3
PrestaShop 1.7.4.4
PrestaShop 1.7.5.0
PrestaShop 1.7.5.0 beta 1
PrestaShop 1.7.5.0 RC 1
PrestaShop 1.7.5.0-beta.1
PrestaShop 1.7.5.0-RC.1
PrestaShop 1.7.5.1
PrestaShop 1.7.5.2
PrestaShop 1.7.6.0
PrestaShop 1.7.6.0 beta 1
PrestaShop 1.7.6.0 RC 1
PrestaShop 1.7.6.0 RC 2
PrestaShop 1.7.6.0-beta.1
PrestaShop 1.7.6.0-RC.1
PrestaShop 1.7.6.0-RC.2
PrestaShop 1.7.6.1
PrestaShop 1.7.6.2
PrestaShop 1.7.6.3
PrestaShop 1.7.6.4
PrestaShop 1.7.6.4 1
PrestaShop 1.7.6.5
PrestaShop 1.7.6.5 1
PrestaShop 1.7.6.6
PrestaShop 1.7.6.7
PrestaShop 1.7.6.8
PrestaShop 1.7.6.9
PrestaShop 1.7.7.0
PrestaShop 1.7.7.0 beta 1
PrestaShop 1.7.7.0 beta 2
PrestaShop 1.7.7.0 RC 1
PrestaShop 1.7.7.0-beta.1
PrestaShop 1.7.7.0-beta.2
PrestaShop 1.7.7.0-RC.1
PrestaShop 1.7.7.1
PrestaShop 1.7.7.2
PrestaShop 1.7.7.3
PrestaShop 1.7.7.4
PrestaShop 1.7.7.5
PrestaShop 1.7.7.6
PrestaShop 1.7.7.7
PrestaShop 1.7.7.8
PrestaShop 1.7.7.8 1
PrestaShop 1.7.8.0
PrestaShop 1.7.8.0 beta 1
PrestaShop 1.7.8.0 1
PrestaShop 1.7.8.0 RC 1
PrestaShop 1.7.8.0-beta.1
PrestaShop 1.7.8.0-RC.1
PrestaShop 1.7.8.1
PrestaShop 1.7.8.2
PrestaShop 1.7.8.2 1
PrestaShop 1.7.8.3
PrestaShop 1.7.8.4
PrestaShop 1.7.8.5
PrestaShop 1.7.8.6
PrestaShop 1.7.8.7
PrestaShop 1.7.8.7 1
PrestaShop 1.7.8.8
PrestaShop 1.7.8.9
PrestaShop 1.7.8.10
PrestaShop 1.7.8.11
PrestaShop 8.0.0
PrestaShop 8.0.1
PrestaShop 8.0.2
PrestaShop 8.0.3
PrestaShop 8.0.4
PrestaShop 8.0.5
PrestaShop 8.1.0

File deletion via CustomerMessage

Skrevet den 15. august 20235. juni 2026 af i PrestaShop

It is possible to delete files from the server via the CustomerMessage API.

This vulnerability affects the following application versions:

PrestaShop 1.7.0.0
PrestaShop 1.7.0.0 alpha3
PrestaShop 1.7.0.0 alpha4
PrestaShop 1.7.0.0 beta1
PrestaShop 1.7.0.0 beta2
PrestaShop 1.7.0.0 beta3
PrestaShop 1.7.0.0 RC0
PrestaShop 1.7.0.0 RC1
PrestaShop 1.7.0.0 RC2
PrestaShop 1.7.0.0 RC3
PrestaShop 1.7.0.1
PrestaShop 1.7.0.2
PrestaShop 1.7.0.3
PrestaShop 1.7.0.4
PrestaShop 1.7.0.5
PrestaShop 1.7.0.6
PrestaShop 1.7.1.0
PrestaShop 1.7.1.0 beta1
PrestaShop 1.7.1.1
PrestaShop 1.7.1.2
PrestaShop 1.7.2.0
PrestaShop 1.7.2.0 RC 1
PrestaShop 1.7.2.0-RC.1.0
PrestaShop 1.7.2.1
PrestaShop 1.7.2.2
PrestaShop 1.7.2.3
PrestaShop 1.7.2.4
PrestaShop 1.7.2.5
PrestaShop 1.7.3.0
PrestaShop 1.7.3.0 beta 1
PrestaShop 1.7.3.0 RC 1
PrestaShop 1.7.3.1
PrestaShop 1.7.3.2
PrestaShop 1.7.3.3
PrestaShop 1.7.3.4
PrestaShop 1.7.4.0
PrestaShop 1.7.4.0 beta 1
PrestaShop 1.7.4.1
PrestaShop 1.7.4.2
PrestaShop 1.7.4.3
PrestaShop 1.7.4.4
PrestaShop 1.7.5.0
PrestaShop 1.7.5.0 beta 1
PrestaShop 1.7.5.0 RC 1
PrestaShop 1.7.5.0-beta.1
PrestaShop 1.7.5.0-RC.1
PrestaShop 1.7.5.1
PrestaShop 1.7.5.2
PrestaShop 1.7.6.0
PrestaShop 1.7.6.0 beta 1
PrestaShop 1.7.6.0 RC 1
PrestaShop 1.7.6.0 RC 2
PrestaShop 1.7.6.0-beta.1
PrestaShop 1.7.6.0-RC.1
PrestaShop 1.7.6.0-RC.2
PrestaShop 1.7.6.1
PrestaShop 1.7.6.2
PrestaShop 1.7.6.3
PrestaShop 1.7.6.4
PrestaShop 1.7.6.4 1
PrestaShop 1.7.6.5
PrestaShop 1.7.6.5 1
PrestaShop 1.7.6.6
PrestaShop 1.7.6.7
PrestaShop 1.7.6.8
PrestaShop 1.7.6.9
PrestaShop 1.7.7.0
PrestaShop 1.7.7.0 beta 1
PrestaShop 1.7.7.0 beta 2
PrestaShop 1.7.7.0 RC 1
PrestaShop 1.7.7.0-beta.1
PrestaShop 1.7.7.0-beta.2
PrestaShop 1.7.7.0-RC.1
PrestaShop 1.7.7.1
PrestaShop 1.7.7.2
PrestaShop 1.7.7.3
PrestaShop 1.7.7.4
PrestaShop 1.7.7.5
PrestaShop 1.7.7.6
PrestaShop 1.7.7.7
PrestaShop 1.7.7.8
PrestaShop 1.7.7.8 1
PrestaShop 1.7.8.0
PrestaShop 1.7.8.0 beta 1
PrestaShop 1.7.8.0 1
PrestaShop 1.7.8.0 RC 1
PrestaShop 1.7.8.0-beta.1
PrestaShop 1.7.8.0-RC.1
PrestaShop 1.7.8.1
PrestaShop 1.7.8.2
PrestaShop 1.7.8.2 1
PrestaShop 1.7.8.3
PrestaShop 1.7.8.4
PrestaShop 1.7.8.5
PrestaShop 1.7.8.6
PrestaShop 1.7.8.7
PrestaShop 1.7.8.7 1
PrestaShop 1.7.8.8
PrestaShop 1.7.8.9
PrestaShop 1.7.8.10
PrestaShop 1.7.8.11
PrestaShop 8.0.0
PrestaShop 8.0.1
PrestaShop 8.0.2
PrestaShop 8.0.3
PrestaShop 8.0.4
PrestaShop 8.0.5
PrestaShop 8.1.0

SQL manager vulnerability (potential RCE)

Skrevet den 11. august 20235. juni 2026 af i PrestaShop

Remote code execution through SQL injection and arbitrary file write in back office.

This vulnerability affects the following application versions:

PrestaShop 1.7.0.0
PrestaShop 1.7.0.0 alpha3
PrestaShop 1.7.0.0 alpha4
PrestaShop 1.7.0.0 beta1
PrestaShop 1.7.0.0 beta2
PrestaShop 1.7.0.0 beta3
PrestaShop 1.7.0.0 RC0
PrestaShop 1.7.0.0 RC1
PrestaShop 1.7.0.0 RC2
PrestaShop 1.7.0.0 RC3
PrestaShop 1.7.0.1
PrestaShop 1.7.0.2
PrestaShop 1.7.0.3
PrestaShop 1.7.0.4
PrestaShop 1.7.0.5
PrestaShop 1.7.0.6
PrestaShop 1.7.1.0
PrestaShop 1.7.1.0 beta1
PrestaShop 1.7.1.1
PrestaShop 1.7.1.2
PrestaShop 1.7.2.0
PrestaShop 1.7.2.0 RC 1
PrestaShop 1.7.2.0-RC.1.0
PrestaShop 1.7.2.1
PrestaShop 1.7.2.2
PrestaShop 1.7.2.3
PrestaShop 1.7.2.4
PrestaShop 1.7.2.5
PrestaShop 1.7.3.0
PrestaShop 1.7.3.0 beta 1
PrestaShop 1.7.3.0 RC 1
PrestaShop 1.7.3.1
PrestaShop 1.7.3.2
PrestaShop 1.7.3.3
PrestaShop 1.7.3.4
PrestaShop 1.7.4.0
PrestaShop 1.7.4.0 beta 1
PrestaShop 1.7.4.1
PrestaShop 1.7.4.2
PrestaShop 1.7.4.3
PrestaShop 1.7.4.4
PrestaShop 1.7.5.0
PrestaShop 1.7.5.0 beta 1
PrestaShop 1.7.5.0 RC 1
PrestaShop 1.7.5.0-beta.1
PrestaShop 1.7.5.0-RC.1
PrestaShop 1.7.5.1
PrestaShop 1.7.5.2
PrestaShop 1.7.6.0
PrestaShop 1.7.6.0 beta 1
PrestaShop 1.7.6.0 RC 1
PrestaShop 1.7.6.0 RC 2
PrestaShop 1.7.6.0-beta.1
PrestaShop 1.7.6.0-RC.1
PrestaShop 1.7.6.0-RC.2
PrestaShop 1.7.6.1
PrestaShop 1.7.6.2
PrestaShop 1.7.6.3
PrestaShop 1.7.6.4
PrestaShop 1.7.6.4 1
PrestaShop 1.7.6.5
PrestaShop 1.7.6.5 1
PrestaShop 1.7.6.6
PrestaShop 1.7.6.7
PrestaShop 1.7.6.8
PrestaShop 1.7.6.9
PrestaShop 1.7.7.0
PrestaShop 1.7.7.0 beta 1
PrestaShop 1.7.7.0 beta 2
PrestaShop 1.7.7.0 RC 1
PrestaShop 1.7.7.0-beta.1
PrestaShop 1.7.7.0-beta.2
PrestaShop 1.7.7.0-RC.1
PrestaShop 1.7.7.1
PrestaShop 1.7.7.2
PrestaShop 1.7.7.3
PrestaShop 1.7.7.4
PrestaShop 1.7.7.5
PrestaShop 1.7.7.6
PrestaShop 1.7.7.7
PrestaShop 1.7.7.8
PrestaShop 1.7.7.8 1
PrestaShop 1.7.8.0
PrestaShop 1.7.8.0 beta 1
PrestaShop 1.7.8.0 1
PrestaShop 1.7.8.0 RC 1
PrestaShop 1.7.8.0-beta.1
PrestaShop 1.7.8.0-RC.1
PrestaShop 1.7.8.1
PrestaShop 1.7.8.2
PrestaShop 1.7.8.2 1
PrestaShop 1.7.8.3
PrestaShop 1.7.8.4
PrestaShop 1.7.8.5
PrestaShop 1.7.8.6
PrestaShop 1.7.8.7
PrestaShop 1.7.8.7 1
PrestaShop 1.7.8.8
PrestaShop 1.7.8.9
PrestaShop 8.0.0
PrestaShop 8.0.1
PrestaShop 8.0.2
PrestaShop 8.0.3
PrestaShop 8.0.4
PrestaShop 8.1.0

New possible XSS injection through Validate::isCleanHTML method

Skrevet den 9. august 20235. juni 2026 af i PrestaShop

XSS injection through isCleanHTML method.

This vulnerability affects the following application versions:

PrestaShop 1.7.0.0
PrestaShop 1.7.0.0 alpha3
PrestaShop 1.7.0.0 alpha4
PrestaShop 1.7.0.0 beta1
PrestaShop 1.7.0.0 beta2
PrestaShop 1.7.0.0 beta3
PrestaShop 1.7.0.0 RC0
PrestaShop 1.7.0.0 RC1
PrestaShop 1.7.0.0 RC2
PrestaShop 1.7.0.0 RC3
PrestaShop 1.7.0.1
PrestaShop 1.7.0.2
PrestaShop 1.7.0.3
PrestaShop 1.7.0.4
PrestaShop 1.7.0.5
PrestaShop 1.7.0.6
PrestaShop 1.7.1.0
PrestaShop 1.7.1.0 beta1
PrestaShop 1.7.1.1
PrestaShop 1.7.1.2
PrestaShop 1.7.2.0
PrestaShop 1.7.2.0 RC 1
PrestaShop 1.7.2.0-RC.1.0
PrestaShop 1.7.2.1
PrestaShop 1.7.2.2
PrestaShop 1.7.2.3
PrestaShop 1.7.2.4
PrestaShop 1.7.2.5
PrestaShop 1.7.3.0
PrestaShop 1.7.3.0 beta 1
PrestaShop 1.7.3.0 RC 1
PrestaShop 1.7.3.1
PrestaShop 1.7.3.2
PrestaShop 1.7.3.3
PrestaShop 1.7.3.4
PrestaShop 1.7.4.0
PrestaShop 1.7.4.0 beta 1
PrestaShop 1.7.4.1
PrestaShop 1.7.4.2
PrestaShop 1.7.4.3
PrestaShop 1.7.4.4
PrestaShop 1.7.5.0
PrestaShop 1.7.5.0 beta 1
PrestaShop 1.7.5.0 RC 1
PrestaShop 1.7.5.0-beta.1
PrestaShop 1.7.5.0-RC.1
PrestaShop 1.7.5.1
PrestaShop 1.7.5.2
PrestaShop 1.7.6.0
PrestaShop 1.7.6.0 beta 1
PrestaShop 1.7.6.0 RC 1
PrestaShop 1.7.6.0 RC 2
PrestaShop 1.7.6.0-beta.1
PrestaShop 1.7.6.0-RC.1
PrestaShop 1.7.6.0-RC.2
PrestaShop 1.7.6.1
PrestaShop 1.7.6.2
PrestaShop 1.7.6.3
PrestaShop 1.7.6.4
PrestaShop 1.7.6.4 1
PrestaShop 1.7.6.5
PrestaShop 1.7.6.5 1
PrestaShop 1.7.6.6
PrestaShop 1.7.6.7
PrestaShop 1.7.6.8
PrestaShop 1.7.6.9
PrestaShop 1.7.7.0
PrestaShop 1.7.7.0 beta 1
PrestaShop 1.7.7.0 beta 2
PrestaShop 1.7.7.0 RC 1
PrestaShop 1.7.7.0-beta.1
PrestaShop 1.7.7.0-beta.2
PrestaShop 1.7.7.0-RC.1
PrestaShop 1.7.7.1
PrestaShop 1.7.7.2
PrestaShop 1.7.7.3
PrestaShop 1.7.7.4
PrestaShop 1.7.7.5
PrestaShop 1.7.7.6
PrestaShop 1.7.7.7
PrestaShop 1.7.7.8
PrestaShop 1.7.7.8 1
PrestaShop 1.7.8.0
PrestaShop 1.7.8.0 beta 1
PrestaShop 1.7.8.0 1
PrestaShop 1.7.8.0 RC 1
PrestaShop 1.7.8.0-beta.1
PrestaShop 1.7.8.0-RC.1
PrestaShop 1.7.8.1
PrestaShop 1.7.8.2
PrestaShop 1.7.8.2 1
PrestaShop 1.7.8.3
PrestaShop 1.7.8.4
PrestaShop 1.7.8.5
PrestaShop 1.7.8.6
PrestaShop 1.7.8.7
PrestaShop 1.7.8.7 1
PrestaShop 1.7.8.8
PrestaShop 1.7.8.9
PrestaShop 8.0.0
PrestaShop 8.0.1
PrestaShop 8.0.2
PrestaShop 8.0.3
PrestaShop 8.0.4
PrestaShop 8.1.0

Arbitrary file read

Skrevet den 29. juni 20235. juni 2026 af i PrestaShop

It is possible for a user having access to the SQL Manager (Advanced Options -> Database) to arbitrary read any file on the Operating system when using SQL function LOAD_FILE in a SELECT request. So It can access to critical information.

This vulnerability affects the following application versions:

PrestaShop 1.7.5.0
PrestaShop 1.7.5.0 beta 1
PrestaShop 1.7.5.0 RC 1
PrestaShop 1.7.5.0-beta.1
PrestaShop 1.7.5.0-RC.1
PrestaShop 1.7.5.1
PrestaShop 1.7.5.2
PrestaShop 1.7.6.0
PrestaShop 1.7.6.0 beta 1
PrestaShop 1.7.6.0 RC 1
PrestaShop 1.7.6.0 RC 2
PrestaShop 1.7.6.0-beta.1
PrestaShop 1.7.6.0-RC.1
PrestaShop 1.7.6.0-RC.2
PrestaShop 1.7.6.1
PrestaShop 1.7.6.2
PrestaShop 1.7.6.3
PrestaShop 1.7.6.4
PrestaShop 1.7.6.4 1
PrestaShop 1.7.6.5
PrestaShop 1.7.6.5 1
PrestaShop 1.7.6.6
PrestaShop 1.7.6.7
PrestaShop 1.7.6.8
PrestaShop 1.7.6.9
PrestaShop 1.7.7.0
PrestaShop 1.7.7.0 beta 1
PrestaShop 1.7.7.0 beta 2
PrestaShop 1.7.7.0 RC 1
PrestaShop 1.7.7.0-beta.1
PrestaShop 1.7.7.0-beta.2
PrestaShop 1.7.7.0-RC.1
PrestaShop 1.7.7.1
PrestaShop 1.7.7.2
PrestaShop 1.7.7.3
PrestaShop 1.7.7.4
PrestaShop 1.7.7.5
PrestaShop 1.7.7.6
PrestaShop 1.7.7.7
PrestaShop 1.7.7.8
PrestaShop 1.7.7.8 1
PrestaShop 1.7.8.0
PrestaShop 1.7.8.0 beta 1
PrestaShop 1.7.8.0 1
PrestaShop 1.7.8.0 RC 1
PrestaShop 1.7.8.0-beta.1
PrestaShop 1.7.8.0-RC.1
PrestaShop 1.7.8.1
PrestaShop 1.7.8.2
PrestaShop 1.7.8.2 1
PrestaShop 1.7.8.3
PrestaShop 1.7.8.4
PrestaShop 1.7.8.5
PrestaShop 1.7.8.6
PrestaShop 1.7.8.7
PrestaShop 1.7.8.7 1
PrestaShop 1.7.8.8
PrestaShop 8.0.0
PrestaShop 8.0.1
PrestaShop 8.0.2
PrestaShop 8.0.3

Possible XSS injection through Validate::isCleanHTML method

Skrevet den 22. juni 20235. juni 2026 af i PrestaShop

ValidateCore::isCleanHTML() method of Prestashop misses hijickable events which can lead to XSS injection, allowed by the presence of pre-setup @Keyframes methods.

This XSS which hijacks HTML attributes will be triggered without any interaction of the visitor/administrator which makes it as dangerous as a trivial XSS.

Contrary to most XSS which target HTML attributes and which are triggered without user interaction (such as onload / onerror which suffer from a very limited scope), this one can hijack every HTML element, which increases the danger due to a complete HTML elements scope.

This vulnerability affects the following application versions:

PrestaShop 1.7.0.0
PrestaShop 1.7.0.0 alpha3
PrestaShop 1.7.0.0 alpha4
PrestaShop 1.7.0.0 beta1
PrestaShop 1.7.0.0 beta2
PrestaShop 1.7.0.0 beta3
PrestaShop 1.7.0.0 RC0
PrestaShop 1.7.0.0 RC1
PrestaShop 1.7.0.0 RC2
PrestaShop 1.7.0.0 RC3
PrestaShop 1.7.0.1
PrestaShop 1.7.0.2
PrestaShop 1.7.0.3
PrestaShop 1.7.0.4
PrestaShop 1.7.0.5
PrestaShop 1.7.0.6
PrestaShop 1.7.1.0
PrestaShop 1.7.1.0 beta1
PrestaShop 1.7.1.1
PrestaShop 1.7.1.2
PrestaShop 1.7.2.0
PrestaShop 1.7.2.0 RC 1
PrestaShop 1.7.2.0-RC.1.0
PrestaShop 1.7.2.1
PrestaShop 1.7.2.2
PrestaShop 1.7.2.3
PrestaShop 1.7.2.4
PrestaShop 1.7.2.5
PrestaShop 1.7.3.0
PrestaShop 1.7.3.0 beta 1
PrestaShop 1.7.3.0 RC 1
PrestaShop 1.7.3.1
PrestaShop 1.7.3.2
PrestaShop 1.7.3.3
PrestaShop 1.7.3.4
PrestaShop 1.7.4.0
PrestaShop 1.7.4.0 beta 1
PrestaShop 1.7.4.1
PrestaShop 1.7.4.2
PrestaShop 1.7.4.3
PrestaShop 1.7.4.4
PrestaShop 1.7.5.0
PrestaShop 1.7.5.0 beta 1
PrestaShop 1.7.5.0 RC 1
PrestaShop 1.7.5.0-beta.1
PrestaShop 1.7.5.0-RC.1
PrestaShop 1.7.5.1
PrestaShop 1.7.5.2
PrestaShop 1.7.6.0
PrestaShop 1.7.6.0 beta 1
PrestaShop 1.7.6.0 RC 1
PrestaShop 1.7.6.0 RC 2
PrestaShop 1.7.6.0-beta.1
PrestaShop 1.7.6.0-RC.1
PrestaShop 1.7.6.0-RC.2
PrestaShop 1.7.6.1
PrestaShop 1.7.6.2
PrestaShop 1.7.6.3
PrestaShop 1.7.6.4
PrestaShop 1.7.6.4 1
PrestaShop 1.7.6.5
PrestaShop 1.7.6.5 1
PrestaShop 1.7.6.6
PrestaShop 1.7.6.7
PrestaShop 1.7.6.8
PrestaShop 1.7.6.9
PrestaShop 1.7.7.0
PrestaShop 1.7.7.0 beta 1
PrestaShop 1.7.7.0 beta 2
PrestaShop 1.7.7.0 RC 1
PrestaShop 1.7.7.0-beta.1
PrestaShop 1.7.7.0-beta.2
PrestaShop 1.7.7.0-RC.1
PrestaShop 1.7.7.1
PrestaShop 1.7.7.2
PrestaShop 1.7.7.3
PrestaShop 1.7.7.4
PrestaShop 1.7.7.5
PrestaShop 1.7.7.6
PrestaShop 1.7.7.7
PrestaShop 1.7.7.8
PrestaShop 1.7.7.8 1
PrestaShop 1.7.8.0
PrestaShop 1.7.8.0 beta 1
PrestaShop 1.7.8.0 1
PrestaShop 1.7.8.0 RC 1
PrestaShop 1.7.8.0-beta.1
PrestaShop 1.7.8.0-RC.1
PrestaShop 1.7.8.1
PrestaShop 1.7.8.2
PrestaShop 1.7.8.2 1
PrestaShop 1.7.8.3
PrestaShop 1.7.8.4
PrestaShop 1.7.8.5
PrestaShop 1.7.8.6
PrestaShop 1.7.8.7
PrestaShop 1.7.8.7 1
PrestaShop 1.7.8.8
PrestaShop 8.0.0
PrestaShop 8.0.1
PrestaShop 8.0.2
PrestaShop 8.0.3

SQL filter bypass leading to arbitrary write requests using “SQL Manager”

Skrevet den 20. juni 20235. juni 2026 af i PrestaShop

SQL filtering vulnerability, a BO user can write, update and delete in the database, even without having specific rights.

This vulnerability affects the following application versions:

PrestaShop 1.6.1.1
PrestaShop 1.6.1.1 RC1
PrestaShop 1.6.1.1 RC2
PrestaShop 1.6.1.2
PrestaShop 1.6.1.2 RC1
PrestaShop 1.6.1.2 RC2
PrestaShop 1.6.1.2 RC3
PrestaShop 1.6.1.2 RC4
PrestaShop 1.6.1.3
PrestaShop 1.6.1.3 RC1
PrestaShop 1.6.1.4
PrestaShop 1.6.1.5
PrestaShop 1.6.1.6
PrestaShop 1.6.1.7
PrestaShop 1.6.1.8
PrestaShop 1.6.1.9
PrestaShop 1.6.1.10
PrestaShop 1.6.1.11
PrestaShop 1.6.1.11 beta 1
PrestaShop 1.6.1.11-beta.1.0
PrestaShop 1.6.1.12
PrestaShop 1.6.1.13
PrestaShop 1.6.1.14
PrestaShop 1.6.1.15
PrestaShop 1.6.1.16
PrestaShop 1.6.1.17
PrestaShop 1.6.1.18
PrestaShop 1.6.1.19
PrestaShop 1.6.1.20
PrestaShop 1.6.1.21
PrestaShop 1.6.1.22
PrestaShop 1.6.1.23
PrestaShop 1.6.1.24
PrestaShop 1.7.0.0
PrestaShop 1.7.0.0 alpha3
PrestaShop 1.7.0.0 alpha4
PrestaShop 1.7.0.0 beta1
PrestaShop 1.7.0.0 beta2
PrestaShop 1.7.0.0 beta3
PrestaShop 1.7.0.0 RC0
PrestaShop 1.7.0.0 RC1
PrestaShop 1.7.0.0 RC2
PrestaShop 1.7.0.0 RC3
PrestaShop 1.7.0.1
PrestaShop 1.7.0.2
PrestaShop 1.7.0.3
PrestaShop 1.7.0.4
PrestaShop 1.7.0.5
PrestaShop 1.7.0.6
PrestaShop 1.7.1.0
PrestaShop 1.7.1.0 beta1
PrestaShop 1.7.1.1
PrestaShop 1.7.1.2
PrestaShop 1.7.2.0
PrestaShop 1.7.2.0 RC 1
PrestaShop 1.7.2.0-RC.1.0
PrestaShop 1.7.2.1
PrestaShop 1.7.2.2
PrestaShop 1.7.2.3
PrestaShop 1.7.2.4
PrestaShop 1.7.2.5
PrestaShop 1.7.3.0
PrestaShop 1.7.3.0 beta 1
PrestaShop 1.7.3.0 RC 1
PrestaShop 1.7.3.1
PrestaShop 1.7.3.2
PrestaShop 1.7.3.3
PrestaShop 1.7.3.4
PrestaShop 1.7.4.0
PrestaShop 1.7.4.0 beta 1
PrestaShop 1.7.4.1
PrestaShop 1.7.4.2
PrestaShop 1.7.4.3
PrestaShop 1.7.4.4
PrestaShop 1.7.5.0
PrestaShop 1.7.5.0 beta 1
PrestaShop 1.7.5.0 RC 1
PrestaShop 1.7.5.0-beta.1
PrestaShop 1.7.5.0-RC.1
PrestaShop 1.7.5.1
PrestaShop 1.7.5.2
PrestaShop 1.7.6.0
PrestaShop 1.7.6.0 beta 1
PrestaShop 1.7.6.0 RC 1
PrestaShop 1.7.6.0 RC 2
PrestaShop 1.7.6.0-beta.1
PrestaShop 1.7.6.0-RC.1
PrestaShop 1.7.6.0-RC.2
PrestaShop 1.7.6.1
PrestaShop 1.7.6.2
PrestaShop 1.7.6.3
PrestaShop 1.7.6.4
PrestaShop 1.7.6.4 1
PrestaShop 1.7.6.5
PrestaShop 1.7.6.5 1
PrestaShop 1.7.6.6
PrestaShop 1.7.6.7
PrestaShop 1.7.6.8
PrestaShop 1.7.6.9
PrestaShop 1.7.7.0
PrestaShop 1.7.7.0 beta 1
PrestaShop 1.7.7.0 beta 2
PrestaShop 1.7.7.0 RC 1
PrestaShop 1.7.7.0-beta.1
PrestaShop 1.7.7.0-beta.2
PrestaShop 1.7.7.0-RC.1
PrestaShop 1.7.7.1
PrestaShop 1.7.7.2
PrestaShop 1.7.7.3
PrestaShop 1.7.7.4
PrestaShop 1.7.7.5
PrestaShop 1.7.7.6
PrestaShop 1.7.7.7
PrestaShop 1.7.7.8
PrestaShop 1.7.7.8 1
PrestaShop 1.7.8.0
PrestaShop 1.7.8.0 beta 1
PrestaShop 1.7.8.0 1
PrestaShop 1.7.8.0 RC 1
PrestaShop 1.7.8.0-beta.1
PrestaShop 1.7.8.0-RC.1
PrestaShop 1.7.8.1
PrestaShop 1.7.8.2
PrestaShop 1.7.8.2 1
PrestaShop 1.7.8.3
PrestaShop 1.7.8.4
PrestaShop 1.7.8.5
PrestaShop 1.7.8.6
PrestaShop 1.7.8.7
PrestaShop 1.7.8.7 1
PrestaShop 1.7.8.8
PrestaShop 8.0.0
PrestaShop 8.0.1
PrestaShop 8.0.2
PrestaShop 8.0.3

Server side twig template injection

Skrevet den 1. marts 2022 af i PrestaShop

An attacker is able to inject twig code inside the back office when using the legacy layout.

This vulnerability affects the following application versions:

PrestaShop 1.7.0.0
PrestaShop 1.7.0.0 alpha3
PrestaShop 1.7.0.0 alpha4
PrestaShop 1.7.0.0 beta1
PrestaShop 1.7.0.0 beta2
PrestaShop 1.7.0.0 beta3
PrestaShop 1.7.0.0 RC0
PrestaShop 1.7.0.0 RC1
PrestaShop 1.7.0.0 RC2
PrestaShop 1.7.0.0 RC3
PrestaShop 1.7.0.1
PrestaShop 1.7.0.2
PrestaShop 1.7.0.3
PrestaShop 1.7.0.4
PrestaShop 1.7.0.5
PrestaShop 1.7.0.6
PrestaShop 1.7.1.0
PrestaShop 1.7.1.0 beta1
PrestaShop 1.7.1.1
PrestaShop 1.7.1.2
PrestaShop 1.7.2.0
PrestaShop 1.7.2.0 RC 1
PrestaShop 1.7.2.1
PrestaShop 1.7.2.2
PrestaShop 1.7.2.3
PrestaShop 1.7.2.4
PrestaShop 1.7.2.5
PrestaShop 1.7.3.0
PrestaShop 1.7.3.0 beta 1
PrestaShop 1.7.3.0 RC 1
PrestaShop 1.7.3.1
PrestaShop 1.7.3.2
PrestaShop 1.7.3.3
PrestaShop 1.7.3.4
PrestaShop 1.7.4.0
PrestaShop 1.7.4.0 beta 1
PrestaShop 1.7.4.1
PrestaShop 1.7.4.2
PrestaShop 1.7.4.3
PrestaShop 1.7.4.4
PrestaShop 1.7.5.0
PrestaShop 1.7.5.0 beta 1
PrestaShop 1.7.5.0 RC 1
PrestaShop 1.7.5.1
PrestaShop 1.7.5.2
PrestaShop 1.7.6.0
PrestaShop 1.7.6.0 beta 1
PrestaShop 1.7.6.0 RC 1
PrestaShop 1.7.6.0 RC 2
PrestaShop 1.7.6.1
PrestaShop 1.7.6.2
PrestaShop 1.7.6.3
PrestaShop 1.7.6.4
PrestaShop 1.7.6.4 1
PrestaShop 1.7.6.5
PrestaShop 1.7.6.5 1
PrestaShop 1.7.6.6
PrestaShop 1.7.6.7
PrestaShop 1.7.6.8
PrestaShop 1.7.6.9
PrestaShop 1.7.7.0
PrestaShop 1.7.7.0 beta 1
PrestaShop 1.7.7.0 beta 2
PrestaShop 1.7.7.0 RC 1
PrestaShop 1.7.7.1
PrestaShop 1.7.7.2
PrestaShop 1.7.7.3
PrestaShop 1.7.7.4
PrestaShop 1.7.7.5
PrestaShop 1.7.7.6
PrestaShop 1.7.7.7
PrestaShop 1.7.7.8
PrestaShop 1.7.7.8 1
PrestaShop 1.7.8.0
PrestaShop 1.7.8.0 1
PrestaShop 1.7.8.0 beta 1
PrestaShop 1.7.8.0 RC 1
PrestaShop 1.7.8.1
PrestaShop 1.7.8.2
PrestaShop 1.7.8.2 1
PrestaShop show

Blind SQLi using Search filters [CVE-2021-43789]

Skrevet den 14. december 20215. juni 2026 af i PrestaShop

Blind SQLi using Search filters with orderBy and sortOrder parameters.

This vulnerability affects the following application versions:

PrestaShop 1.7.6.0
PrestaShop 1.7.6.0 beta 1
PrestaShop 1.7.6.0 RC 1
PrestaShop 1.7.6.0 RC 2
PrestaShop 1.7.6.0-beta.1
PrestaShop 1.7.6.0-RC.1
PrestaShop 1.7.6.0-RC.2
PrestaShop 1.7.6.1
PrestaShop 1.7.6.2
PrestaShop 1.7.6.3
PrestaShop 1.7.6.4
PrestaShop 1.7.6.4 1
PrestaShop 1.7.6.5
PrestaShop 1.7.6.5 1
PrestaShop 1.7.6.6
PrestaShop 1.7.6.7
PrestaShop 1.7.6.8
PrestaShop 1.7.6.9
PrestaShop 1.7.7.0
PrestaShop 1.7.7.0 beta 1
PrestaShop 1.7.7.0 beta 2
PrestaShop 1.7.7.0 RC 1
PrestaShop 1.7.7.0-beta.1
PrestaShop 1.7.7.0-beta.2
PrestaShop 1.7.7.0-RC.1
PrestaShop 1.7.7.1
PrestaShop 1.7.7.2
PrestaShop 1.7.7.3
PrestaShop 1.7.7.4
PrestaShop 1.7.7.5
PrestaShop 1.7.7.6
PrestaShop 1.7.7.7
PrestaShop 1.7.7.8
PrestaShop 1.7.7.8 1
PrestaShop 1.7.8.0
PrestaShop 1.7.8.0 beta 1
PrestaShop 1.7.8.0 1
PrestaShop 1.7.8.0 RC 1
PrestaShop 1.7.8.0-beta.1
PrestaShop 1.7.8.0-RC.1
PrestaShop 1.7.8.1

XSS in currency and tax rule data

Skrevet den 24. november 20215. juni 2026 af i PrestaShop

The currency and tax rule data isn’t correctly escaped which can lead to XSS.

This vulnerability affects the following application versions:

PrestaShop 1.7.2.0
PrestaShop 1.7.2.0 RC 1
PrestaShop 1.7.2.0-RC.1.0
PrestaShop 1.7.2.1
PrestaShop 1.7.2.2
PrestaShop 1.7.2.3
PrestaShop 1.7.2.4
PrestaShop 1.7.2.5
PrestaShop 1.7.3.0
PrestaShop 1.7.3.0 beta 1
PrestaShop 1.7.3.0 RC 1
PrestaShop 1.7.3.1
PrestaShop 1.7.3.2
PrestaShop 1.7.3.3
PrestaShop 1.7.3.4
PrestaShop 1.7.4.0
PrestaShop 1.7.4.0 beta 1
PrestaShop 1.7.4.1
PrestaShop 1.7.4.2
PrestaShop 1.7.4.3
PrestaShop 1.7.4.4
PrestaShop 1.7.5.0
PrestaShop 1.7.5.0 beta 1
PrestaShop 1.7.5.0 RC 1
PrestaShop 1.7.5.0-beta.1
PrestaShop 1.7.5.0-RC.1
PrestaShop 1.7.5.1
PrestaShop 1.7.5.2
PrestaShop 1.7.6.0
PrestaShop 1.7.6.0 beta 1
PrestaShop 1.7.6.0 RC 1
PrestaShop 1.7.6.0 RC 2
PrestaShop 1.7.6.0-beta.1
PrestaShop 1.7.6.0-RC.1
PrestaShop 1.7.6.0-RC.2
PrestaShop 1.7.6.1
PrestaShop 1.7.6.2
PrestaShop 1.7.6.3
PrestaShop 1.7.6.4
PrestaShop 1.7.6.4 1
PrestaShop 1.7.6.5
PrestaShop 1.7.6.5 1
PrestaShop 1.7.6.6
PrestaShop 1.7.6.7
PrestaShop 1.7.6.8
PrestaShop 1.7.6.9
PrestaShop 1.7.7.0
PrestaShop 1.7.7.0 beta 1
PrestaShop 1.7.7.0 beta 2
PrestaShop 1.7.7.0 RC 1
PrestaShop 1.7.7.0-beta.1
PrestaShop 1.7.7.0-beta.2
PrestaShop 1.7.7.0-RC.1
PrestaShop 1.7.7.1
PrestaShop 1.7.7.2
PrestaShop 1.7.7.3
PrestaShop 1.7.7.4
PrestaShop 1.7.7.5
PrestaShop 1.7.7.6
PrestaShop 1.7.7.7
PrestaShop 1.7.7.8
PrestaShop 1.7.7.8 1
PrestaShop 1.7.8.0 beta 1
PrestaShop 1.7.8.0-beta.1

XSS in the product rule

Skrevet den 8. november 20215. juni 2026 af i PrestaShop

The product rule controller isn’t properly escaped against XSS attack.

This vulnerability affects the following application versions:

PrestaShop 1.6.0.2
PrestaShop 1.6.0.2 alpha 2
PrestaShop 1.6.0.3
PrestaShop 1.6.0.3 beta 1
PrestaShop 1.6.0.4
PrestaShop 1.6.0.4 RC1
PrestaShop 1.6.0.5
PrestaShop 1.6.0.6
PrestaShop 1.6.0.7
PrestaShop 1.6.0.8
PrestaShop 1.6.0.9
PrestaShop 1.6.0.10
PrestaShop 1.6.0.11
PrestaShop 1.6.0.12
PrestaShop 1.6.0.13
PrestaShop 1.6.0.14
PrestaShop 1.6.1.0
PrestaShop 1.6.1.0 RC4
PrestaShop 1.6.1.0 RC5
PrestaShop 1.6.1.1
PrestaShop 1.6.1.1 RC1
PrestaShop 1.6.1.1 RC2
PrestaShop 1.6.1.2
PrestaShop 1.6.1.2 RC1
PrestaShop 1.6.1.2 RC2
PrestaShop 1.6.1.2 RC3
PrestaShop 1.6.1.2 RC4
PrestaShop 1.6.1.3
PrestaShop 1.6.1.3 RC1
PrestaShop 1.6.1.4
PrestaShop 1.6.1.5
PrestaShop 1.6.1.6
PrestaShop 1.6.1.7
PrestaShop 1.6.1.8
PrestaShop 1.6.1.9
PrestaShop 1.6.1.10
PrestaShop 1.6.1.11
PrestaShop 1.6.1.11 beta 1
PrestaShop 1.6.1.11-beta.1.0
PrestaShop 1.6.1.12
PrestaShop 1.6.1.13
PrestaShop 1.6.1.14
PrestaShop 1.6.1.15
PrestaShop 1.6.1.16
PrestaShop 1.6.1.17
PrestaShop 1.6.1.18
PrestaShop 1.6.1.19
PrestaShop 1.6.1.20
PrestaShop 1.6.1.21
PrestaShop 1.6.1.22
PrestaShop 1.6.1.23
PrestaShop 1.6.1.24
PrestaShop 1.7.0.0
PrestaShop 1.7.0.0 alpha3
PrestaShop 1.7.0.0 alpha4
PrestaShop 1.7.0.0 beta1
PrestaShop 1.7.0.0 beta2
PrestaShop 1.7.0.0 beta3
PrestaShop 1.7.0.0 RC0
PrestaShop 1.7.0.0 RC1
PrestaShop 1.7.0.0 RC2
PrestaShop 1.7.0.0 RC3
PrestaShop 1.7.0.1
PrestaShop 1.7.0.2
PrestaShop 1.7.0.3
PrestaShop 1.7.0.4
PrestaShop 1.7.0.5
PrestaShop 1.7.0.6
PrestaShop 1.7.1.0
PrestaShop 1.7.1.0 beta1
PrestaShop 1.7.1.1
PrestaShop 1.7.1.2
PrestaShop 1.7.2.0
PrestaShop 1.7.2.0 RC 1
PrestaShop 1.7.2.0-RC.1.0
PrestaShop 1.7.2.1
PrestaShop 1.7.2.2
PrestaShop 1.7.2.3
PrestaShop 1.7.2.4
PrestaShop 1.7.2.5
PrestaShop 1.7.3.0
PrestaShop 1.7.3.0 beta 1
PrestaShop 1.7.3.0 RC 1
PrestaShop 1.7.3.1
PrestaShop 1.7.3.2
PrestaShop 1.7.3.3
PrestaShop 1.7.3.4
PrestaShop 1.7.4.0
PrestaShop 1.7.4.0 beta 1
PrestaShop 1.7.4.1
PrestaShop 1.7.4.2
PrestaShop 1.7.4.3
PrestaShop 1.7.4.4
PrestaShop 1.7.5.0
PrestaShop 1.7.5.0 beta 1
PrestaShop 1.7.5.0 RC 1
PrestaShop 1.7.5.0-beta.1
PrestaShop 1.7.5.0-RC.1
PrestaShop 1.7.5.1
PrestaShop 1.7.5.2
PrestaShop 1.7.6.0
PrestaShop 1.7.6.0 beta 1
PrestaShop 1.7.6.0 RC 1
PrestaShop 1.7.6.0 RC 2
PrestaShop 1.7.6.0-beta.1
PrestaShop 1.7.6.0-RC.1
PrestaShop 1.7.6.0-RC.2
PrestaShop 1.7.6.1
PrestaShop 1.7.6.2
PrestaShop 1.7.6.3
PrestaShop 1.7.6.4
PrestaShop 1.7.6.4 1
PrestaShop 1.7.6.5
PrestaShop 1.7.6.5 1
PrestaShop 1.7.6.6
PrestaShop 1.7.6.7
PrestaShop 1.7.6.8
PrestaShop 1.7.6.9
PrestaShop 1.7.7.0
PrestaShop 1.7.7.0 beta 1
PrestaShop 1.7.7.0 beta 2
PrestaShop 1.7.7.0 RC 1
PrestaShop 1.7.7.0-beta.1
PrestaShop 1.7.7.0-beta.2
PrestaShop 1.7.7.0-RC.1
PrestaShop 1.7.7.1
PrestaShop 1.7.7.2
PrestaShop 1.7.7.3
PrestaShop 1.7.7.4
PrestaShop 1.7.7.5
PrestaShop 1.7.7.6
PrestaShop 1.7.7.7
PrestaShop 1.7.7.8
PrestaShop 1.7.7.8 1

Added escaping to CSV export to avoid XSS

Skrevet den 16. marts 202124. maj 2026 af i PrestaShop

The content of the CSV file wasn’t properly escaped to prevent XSS.

This vulnerability affects the following application versions:

PrestaShop 1.6.0.3
PrestaShop 1.6.0.3 beta 1
PrestaShop 1.6.0.4
PrestaShop 1.6.0.4 RC1
PrestaShop 1.6.0.5
PrestaShop 1.6.0.6
PrestaShop 1.6.0.7
PrestaShop 1.6.0.8
PrestaShop 1.6.0.9
PrestaShop 1.6.0.10
PrestaShop 1.6.0.11
PrestaShop 1.6.0.12
PrestaShop 1.6.0.13
PrestaShop 1.6.0.14
PrestaShop 1.6.1.0
PrestaShop 1.6.1.0 RC4
PrestaShop 1.6.1.0 RC5
PrestaShop 1.6.1.1
PrestaShop 1.6.1.1 RC1
PrestaShop 1.6.1.1 RC2
PrestaShop 1.6.1.2
PrestaShop 1.6.1.2 RC1
PrestaShop 1.6.1.2 RC2
PrestaShop 1.6.1.2 RC3
PrestaShop 1.6.1.2 RC4
PrestaShop 1.6.1.3
PrestaShop 1.6.1.3 RC1
PrestaShop 1.6.1.4
PrestaShop 1.6.1.5
PrestaShop 1.6.1.6
PrestaShop 1.6.1.7
PrestaShop 1.6.1.8
PrestaShop 1.6.1.9
PrestaShop 1.6.1.10
PrestaShop 1.6.1.11
PrestaShop 1.6.1.11 beta 1
PrestaShop 1.6.1.11-beta.1.0
PrestaShop 1.6.1.12
PrestaShop 1.6.1.13
PrestaShop 1.6.1.14
PrestaShop 1.6.1.15
PrestaShop 1.6.1.16
PrestaShop 1.6.1.17
PrestaShop 1.6.1.18
PrestaShop 1.6.1.19
PrestaShop 1.6.1.20
PrestaShop 1.6.1.21
PrestaShop 1.6.1.22
PrestaShop 1.6.1.23
PrestaShop 1.6.1.24
PrestaShop 1.7.0.0
PrestaShop 1.7.0.0 beta1
PrestaShop 1.7.0.0 beta2
PrestaShop 1.7.0.0 beta3
PrestaShop 1.7.0.0 RC0
PrestaShop 1.7.0.0 RC1
PrestaShop 1.7.0.0 RC2
PrestaShop 1.7.0.0 RC3
PrestaShop 1.7.0.1
PrestaShop 1.7.0.2
PrestaShop 1.7.0.3
PrestaShop 1.7.0.4
PrestaShop 1.7.0.5
PrestaShop 1.7.0.6
PrestaShop 1.7.1.0
PrestaShop 1.7.1.0 beta1
PrestaShop 1.7.1.1
PrestaShop 1.7.1.2
PrestaShop 1.7.2.0
PrestaShop 1.7.2.0 RC 1
PrestaShop 1.7.2.0-RC.1.0
PrestaShop 1.7.2.1
PrestaShop 1.7.2.2
PrestaShop 1.7.2.3
PrestaShop 1.7.2.4
PrestaShop 1.7.2.5
PrestaShop 1.7.3.0
PrestaShop 1.7.3.0 beta 1
PrestaShop 1.7.3.0 RC 1
PrestaShop 1.7.3.1
PrestaShop 1.7.3.2
PrestaShop 1.7.3.3
PrestaShop 1.7.3.4
PrestaShop 1.7.4.0
PrestaShop 1.7.4.0 beta 1
PrestaShop 1.7.4.1
PrestaShop 1.7.4.2
PrestaShop 1.7.4.3
PrestaShop 1.7.4.4
PrestaShop 1.7.5.0
PrestaShop 1.7.5.0 beta 1
PrestaShop 1.7.5.0 RC 1
PrestaShop 1.7.5.0-beta.1
PrestaShop 1.7.5.0-RC.1
PrestaShop 1.7.5.1
PrestaShop 1.7.5.2
PrestaShop 1.7.6.0
PrestaShop 1.7.6.0 beta 1
PrestaShop 1.7.6.0 RC 1
PrestaShop 1.7.6.0 RC 2
PrestaShop 1.7.6.0-beta.1
PrestaShop 1.7.6.0-RC.1
PrestaShop 1.7.6.0-RC.2
PrestaShop 1.7.6.1
PrestaShop 1.7.6.2
PrestaShop 1.7.6.3
PrestaShop 1.7.6.4
PrestaShop 1.7.6.4 1
PrestaShop 1.7.6.5
PrestaShop 1.7.6.5 1
PrestaShop 1.7.6.6
PrestaShop 1.7.6.7
PrestaShop 1.7.6.8
PrestaShop 1.7.6.9
PrestaShop 1.7.7.0
PrestaShop 1.7.7.0 beta 1
PrestaShop 1.7.7.0 beta 2
PrestaShop 1.7.7.0 RC 1
PrestaShop 1.7.7.0-beta.1
PrestaShop 1.7.7.0-beta.2
PrestaShop 1.7.7.0-RC.1
PrestaShop 1.7.7.1

Improved logout to avoid unauthenticated actions

Skrevet den 15. marts 202124. maj 2026 af i PrestaShop

Logging out wasn’t clearing the session properly. Therefore delete session is added to soft logout to avoid unauthenticated actions.

This vulnerability affects the following application versions:

PrestaShop 1.7.6.6
PrestaShop 1.7.6.7
PrestaShop 1.7.6.8
PrestaShop 1.7.6.9
PrestaShop 1.7.7.0
PrestaShop 1.7.7.0 beta 2
PrestaShop 1.7.7.0 RC 1
PrestaShop 1.7.7.0-beta.2
PrestaShop 1.7.7.0-RC.1
PrestaShop 1.7.7.1

Extending admin controller check when generating URL for route name

Skrevet den 4. februar 202124. maj 2026 af i PrestaShop

Test if it’s a correct url before continue.

This vulnerability affects the following application versions:

PrestaShop 1.7.0.0
PrestaShop 1.7.0.0 beta1
PrestaShop 1.7.0.0 beta2
PrestaShop 1.7.0.0 beta3
PrestaShop 1.7.0.0 RC0
PrestaShop 1.7.0.0 RC1
PrestaShop 1.7.0.0 RC2
PrestaShop 1.7.0.0 RC3
PrestaShop 1.7.0.1
PrestaShop 1.7.0.2
PrestaShop 1.7.0.3
PrestaShop 1.7.0.4
PrestaShop 1.7.0.5
PrestaShop 1.7.0.6
PrestaShop 1.7.1.0
PrestaShop 1.7.1.0 beta1
PrestaShop 1.7.1.1
PrestaShop 1.7.1.2
PrestaShop 1.7.2.0
PrestaShop 1.7.2.0 RC 1
PrestaShop 1.7.2.0-RC.1.0
PrestaShop 1.7.2.1
PrestaShop 1.7.2.2
PrestaShop 1.7.2.3
PrestaShop 1.7.2.4
PrestaShop 1.7.2.5
PrestaShop 1.7.3.0
PrestaShop 1.7.3.0 beta 1
PrestaShop 1.7.3.0 RC 1
PrestaShop 1.7.3.1
PrestaShop 1.7.3.2
PrestaShop 1.7.3.3
PrestaShop 1.7.3.4
PrestaShop 1.7.4.0
PrestaShop 1.7.4.0 beta 1
PrestaShop 1.7.4.1
PrestaShop 1.7.4.2
PrestaShop 1.7.4.3
PrestaShop 1.7.4.4
PrestaShop 1.7.5.0
PrestaShop 1.7.5.0 beta 1
PrestaShop 1.7.5.0 RC 1
PrestaShop 1.7.5.0-beta.1
PrestaShop 1.7.5.0-RC.1
PrestaShop 1.7.5.1
PrestaShop 1.7.5.2
PrestaShop 1.7.6.0
PrestaShop 1.7.6.0 beta 1
PrestaShop 1.7.6.0 RC 1
PrestaShop 1.7.6.0 RC 2
PrestaShop 1.7.6.0-beta.1
PrestaShop 1.7.6.0-RC.1
PrestaShop 1.7.6.0-RC.2
PrestaShop 1.7.6.1
PrestaShop 1.7.6.2
PrestaShop 1.7.6.3
PrestaShop 1.7.6.4
PrestaShop 1.7.6.4 1

External control of configuration setting in the dashboard

Skrevet den 4. februar 202124. maj 2026 af i PrestaShop

Remove unwanted update in dashboard controller.

This vulnerability affects the following application versions:

PrestaShop 1.6.0.1
PrestaShop 1.6.0.1 alpha 1
PrestaShop 1.6.0.2
PrestaShop 1.6.0.2 alpha 2
PrestaShop 1.6.0.3
PrestaShop 1.6.0.3 beta 1
PrestaShop 1.6.0.4
PrestaShop 1.6.0.4 RC1
PrestaShop 1.6.0.5
PrestaShop 1.6.0.6
PrestaShop 1.6.0.7
PrestaShop 1.6.0.8
PrestaShop 1.6.0.9
PrestaShop 1.6.0.10
PrestaShop 1.6.0.11
PrestaShop 1.6.0.12
PrestaShop 1.6.0.13
PrestaShop 1.6.0.14
PrestaShop 1.6.1.0
PrestaShop 1.6.1.0 RC4
PrestaShop 1.6.1.0 RC5
PrestaShop 1.6.1.1
PrestaShop 1.6.1.1 RC1
PrestaShop 1.6.1.1 RC2
PrestaShop 1.6.1.2
PrestaShop 1.6.1.2 RC1
PrestaShop 1.6.1.2 RC2
PrestaShop 1.6.1.2 RC3
PrestaShop 1.6.1.2 RC4
PrestaShop 1.6.1.3
PrestaShop 1.6.1.3 RC1
PrestaShop 1.6.1.4
PrestaShop 1.6.1.5
PrestaShop 1.6.1.6
PrestaShop 1.6.1.7
PrestaShop 1.6.1.8
PrestaShop 1.6.1.9
PrestaShop 1.6.1.10
PrestaShop 1.6.1.11
PrestaShop 1.6.1.11 beta 1
PrestaShop 1.6.1.11-beta.1.0
PrestaShop 1.6.1.12
PrestaShop 1.6.1.13
PrestaShop 1.6.1.14
PrestaShop 1.6.1.15
PrestaShop 1.6.1.16
PrestaShop 1.6.1.17
PrestaShop 1.6.1.18
PrestaShop 1.6.1.19
PrestaShop 1.6.1.20
PrestaShop 1.6.1.21
PrestaShop 1.6.1.22
PrestaShop 1.6.1.23
PrestaShop 1.6.1.24
PrestaShop 1.7.0.0
PrestaShop 1.7.0.0 alpha3
PrestaShop 1.7.0.0 alpha4
PrestaShop 1.7.0.0 beta1
PrestaShop 1.7.0.0 beta2
PrestaShop 1.7.0.0 beta3
PrestaShop 1.7.0.0 RC0
PrestaShop 1.7.0.0 RC1
PrestaShop 1.7.0.0 RC2
PrestaShop 1.7.0.0 RC3
PrestaShop 1.7.0.1
PrestaShop 1.7.0.2
PrestaShop 1.7.0.3
PrestaShop 1.7.0.4
PrestaShop 1.7.0.5
PrestaShop 1.7.0.6
PrestaShop 1.7.1.0
PrestaShop 1.7.1.0 beta1
PrestaShop 1.7.1.1
PrestaShop 1.7.1.2
PrestaShop 1.7.2.0
PrestaShop 1.7.2.0 RC 1
PrestaShop 1.7.2.0-RC.1.0
PrestaShop 1.7.2.1
PrestaShop 1.7.2.2
PrestaShop 1.7.2.3
PrestaShop 1.7.2.4
PrestaShop 1.7.2.5
PrestaShop 1.7.3.0
PrestaShop 1.7.3.0 beta 1
PrestaShop 1.7.3.0 RC 1
PrestaShop 1.7.3.1
PrestaShop 1.7.3.2
PrestaShop 1.7.3.3
PrestaShop 1.7.3.4
PrestaShop 1.7.4.0
PrestaShop 1.7.4.0 beta 1
PrestaShop 1.7.4.1
PrestaShop 1.7.4.2
PrestaShop 1.7.4.3
PrestaShop 1.7.4.4
PrestaShop 1.7.5.0
PrestaShop 1.7.5.0 beta 1
PrestaShop 1.7.5.0 RC 1
PrestaShop 1.7.5.0-beta.1
PrestaShop 1.7.5.0-RC.1
PrestaShop 1.7.5.1
PrestaShop 1.7.5.2
PrestaShop 1.7.6.0
PrestaShop 1.7.6.0 beta 1
PrestaShop 1.7.6.0 RC 1
PrestaShop 1.7.6.0 RC 2
PrestaShop 1.7.6.0-beta.1
PrestaShop 1.7.6.0-RC.1
PrestaShop 1.7.6.0-RC.2
PrestaShop 1.7.6.1
PrestaShop 1.7.6.2
PrestaShop 1.7.6.3
PrestaShop 1.7.6.4
PrestaShop 1.7.6.4 1
PrestaShop 1.7.6.5
PrestaShop 1.7.6.5 1

Added escaping to several admin controllers and send mail to prevent XSS

Skrevet den 23. november 202024. maj 2026 af i PrestaShop

Several sections in admin controllers and send mail were not properly escaped against XSS.

This vulnerability affects the following application versions:

PrestaShop 1.6.0.1
PrestaShop 1.6.0.1 alpha 1
PrestaShop 1.6.0.2
PrestaShop 1.6.0.2 alpha 2
PrestaShop 1.6.0.3
PrestaShop 1.6.0.3 beta 1
PrestaShop 1.6.0.4
PrestaShop 1.6.0.4 RC1
PrestaShop 1.6.0.5
PrestaShop 1.6.0.6
PrestaShop 1.6.0.7
PrestaShop 1.6.0.8
PrestaShop 1.6.0.9
PrestaShop 1.6.0.10
PrestaShop 1.6.0.11
PrestaShop 1.6.0.12
PrestaShop 1.6.0.13
PrestaShop 1.6.0.14
PrestaShop 1.6.1.0
PrestaShop 1.6.1.0 RC4
PrestaShop 1.6.1.0 RC5
PrestaShop 1.6.1.1
PrestaShop 1.6.1.1 RC1
PrestaShop 1.6.1.1 RC2
PrestaShop 1.6.1.2
PrestaShop 1.6.1.2 RC1
PrestaShop 1.6.1.2 RC2
PrestaShop 1.6.1.2 RC3
PrestaShop 1.6.1.2 RC4
PrestaShop 1.6.1.3
PrestaShop 1.6.1.3 RC1
PrestaShop 1.6.1.4
PrestaShop 1.6.1.5
PrestaShop 1.6.1.6
PrestaShop 1.6.1.7
PrestaShop 1.6.1.8
PrestaShop 1.6.1.9
PrestaShop 1.6.1.10
PrestaShop 1.6.1.11
PrestaShop 1.6.1.11 beta 1
PrestaShop 1.6.1.11-beta.1.0
PrestaShop 1.6.1.12
PrestaShop 1.6.1.13
PrestaShop 1.6.1.14
PrestaShop 1.6.1.15
PrestaShop 1.6.1.16
PrestaShop 1.6.1.17
PrestaShop 1.6.1.18
PrestaShop 1.6.1.19
PrestaShop 1.6.1.20
PrestaShop 1.6.1.21
PrestaShop 1.6.1.22
PrestaShop 1.6.1.23
PrestaShop 1.6.1.24
PrestaShop 1.7.0.0
PrestaShop 1.7.0.0 beta1
PrestaShop 1.7.0.0 beta2
PrestaShop 1.7.0.0 beta3
PrestaShop 1.7.0.0 RC0
PrestaShop 1.7.0.0 RC1
PrestaShop 1.7.0.0 RC2
PrestaShop 1.7.0.0 RC3
PrestaShop 1.7.0.1
PrestaShop 1.7.0.2
PrestaShop 1.7.0.3
PrestaShop 1.7.0.4
PrestaShop 1.7.0.5
PrestaShop 1.7.0.6
PrestaShop 1.7.1.0
PrestaShop 1.7.1.0 beta1
PrestaShop 1.7.1.1
PrestaShop 1.7.1.2
PrestaShop 1.7.2.0
PrestaShop 1.7.2.0 RC 1
PrestaShop 1.7.2.0-RC.1.0
PrestaShop 1.7.2.1
PrestaShop 1.7.2.2
PrestaShop 1.7.2.3
PrestaShop 1.7.2.4
PrestaShop 1.7.2.5
PrestaShop 1.7.3.0
PrestaShop 1.7.3.0 beta 1
PrestaShop 1.7.3.0 RC 1
PrestaShop 1.7.3.1
PrestaShop 1.7.3.2
PrestaShop 1.7.3.3
PrestaShop 1.7.3.4
PrestaShop 1.7.4.0
PrestaShop 1.7.4.0 beta 1
PrestaShop 1.7.4.1
PrestaShop 1.7.4.2
PrestaShop 1.7.4.3
PrestaShop 1.7.4.4
PrestaShop 1.7.5.0
PrestaShop 1.7.5.0 beta 1
PrestaShop 1.7.5.0 RC 1
PrestaShop 1.7.5.0-beta.1
PrestaShop 1.7.5.0-RC.1
PrestaShop 1.7.5.1
PrestaShop 1.7.5.2
PrestaShop 1.7.6.0
PrestaShop 1.7.6.0 beta 1
PrestaShop 1.7.6.0 RC 1
PrestaShop 1.7.6.0 RC 2
PrestaShop 1.7.6.0-beta.1
PrestaShop 1.7.6.0-RC.1
PrestaShop 1.7.6.0-RC.2
PrestaShop 1.7.6.1
PrestaShop 1.7.6.2
PrestaShop 1.7.6.3
PrestaShop 1.7.6.4
PrestaShop 1.7.6.4 1
PrestaShop 1.7.6.5
PrestaShop 1.7.6.5 1
PrestaShop 1.7.6.6
PrestaShop 1.7.6.7

Blind SQLi in catalog product edition

Skrevet den 23. november 202024. maj 2026 af i PrestaShop

Blind SQLi in the catalog product edition page with location parameter.

This vulnerability affects the following application versions:

PrestaShop 1.7.5.0
PrestaShop 1.7.5.0 beta 1
PrestaShop 1.7.5.0 RC 1
PrestaShop 1.7.5.0-beta.1
PrestaShop 1.7.5.0-RC.1
PrestaShop 1.7.5.1
PrestaShop 1.7.5.2
PrestaShop 1.7.6.0
PrestaShop 1.7.6.0 beta 1
PrestaShop 1.7.6.0 RC 1
PrestaShop 1.7.6.0 RC 2
PrestaShop 1.7.6.0-beta.1
PrestaShop 1.7.6.0-RC.1
PrestaShop 1.7.6.0-RC.2
PrestaShop 1.7.6.1
PrestaShop 1.7.6.2
PrestaShop 1.7.6.3
PrestaShop 1.7.6.4
PrestaShop 1.7.6.4 1
PrestaShop 1.7.6.5
PrestaShop 1.7.6.5 1
PrestaShop 1.7.6.6
PrestaShop 1.7.6.7

Improper access control with submitReorder function

Skrevet den 18. november 202024. maj 2026 af i PrestaShop

An attacker was able to list all the orders placed on the website without being logged by abusing the function that allowed a shopping cart to be recreated from an order already placed.

This vulnerability affects the following application versions:

PrestaShop 1.7.0.0
PrestaShop 1.7.0.0 beta1
PrestaShop 1.7.0.0 beta2
PrestaShop 1.7.0.0 beta3
PrestaShop 1.7.0.0 RC0
PrestaShop 1.7.0.0 RC1
PrestaShop 1.7.0.0 RC2
PrestaShop 1.7.0.0 RC3
PrestaShop 1.7.0.1
PrestaShop 1.7.0.2
PrestaShop 1.7.0.3
PrestaShop 1.7.0.4
PrestaShop 1.7.0.5
PrestaShop 1.7.0.6
PrestaShop 1.7.1.0
PrestaShop 1.7.1.0 beta1
PrestaShop 1.7.1.1
PrestaShop 1.7.1.2
PrestaShop 1.7.2.0
PrestaShop 1.7.2.0 RC 1
PrestaShop 1.7.2.0-RC.1.0
PrestaShop 1.7.2.1
PrestaShop 1.7.2.2
PrestaShop 1.7.2.3
PrestaShop 1.7.2.4
PrestaShop 1.7.2.5
PrestaShop 1.7.3.0
PrestaShop 1.7.3.0 beta 1
PrestaShop 1.7.3.0 RC 1
PrestaShop 1.7.3.1
PrestaShop 1.7.3.2
PrestaShop 1.7.3.3
PrestaShop 1.7.3.4
PrestaShop 1.7.4.0
PrestaShop 1.7.4.0 beta 1
PrestaShop 1.7.4.1
PrestaShop 1.7.4.2
PrestaShop 1.7.4.3
PrestaShop 1.7.4.4
PrestaShop 1.7.5.0
PrestaShop 1.7.5.0 beta 1
PrestaShop 1.7.5.0 RC 1
PrestaShop 1.7.5.0-beta.1
PrestaShop 1.7.5.0-RC.1
PrestaShop 1.7.5.1
PrestaShop 1.7.5.2
PrestaShop 1.7.6.0
PrestaShop 1.7.6.0 beta 1
PrestaShop 1.7.6.0 RC 1
PrestaShop 1.7.6.0 RC 2
PrestaShop 1.7.6.0-beta.1
PrestaShop 1.7.6.0-RC.1
PrestaShop 1.7.6.0-RC.2
PrestaShop 1.7.6.1
PrestaShop 1.7.6.2
PrestaShop 1.7.6.3
PrestaShop 1.7.6.4
PrestaShop 1.7.6.4 1
PrestaShop 1.7.6.5
PrestaShop 1.7.6.5 1
PrestaShop 1.7.6.6
PrestaShop 1.7.6.7
PrestaShop 1.7.6.8

Added access check for isFree table in admin section to prevent unauthorized access

Skrevet den 12. november 202024. maj 2026 af i PrestaShop

Access to isFree table in admin section wasn’t properly checked.

This vulnerability affects the following application versions:

PrestaShop 1.7.0.0
PrestaShop 1.7.0.0 beta1
PrestaShop 1.7.0.0 beta2
PrestaShop 1.7.0.0 beta3
PrestaShop 1.7.0.0 RC0
PrestaShop 1.7.0.0 RC1
PrestaShop 1.7.0.0 RC2
PrestaShop 1.7.0.0 RC3
PrestaShop 1.7.0.1
PrestaShop 1.7.0.2
PrestaShop 1.7.0.3
PrestaShop 1.7.0.4
PrestaShop 1.7.0.5
PrestaShop 1.7.0.6
PrestaShop 1.7.1.0
PrestaShop 1.7.1.0 beta1
PrestaShop 1.7.1.1
PrestaShop 1.7.1.2
PrestaShop 1.7.2.0
PrestaShop 1.7.2.0 RC 1
PrestaShop 1.7.2.0-RC.1.0
PrestaShop 1.7.2.1
PrestaShop 1.7.2.2
PrestaShop 1.7.2.3
PrestaShop 1.7.2.4
PrestaShop 1.7.2.5
PrestaShop 1.7.3.0
PrestaShop 1.7.3.0 beta 1
PrestaShop 1.7.3.0 RC 1
PrestaShop 1.7.3.1
PrestaShop 1.7.3.2
PrestaShop 1.7.3.3
PrestaShop 1.7.3.4
PrestaShop 1.7.4.0
PrestaShop 1.7.4.0 beta 1
PrestaShop 1.7.4.1
PrestaShop 1.7.4.2
PrestaShop 1.7.4.3
PrestaShop 1.7.4.4
PrestaShop 1.7.5.0
PrestaShop 1.7.5.0 beta 1
PrestaShop 1.7.5.0 RC 1
PrestaShop 1.7.5.0-beta.1
PrestaShop 1.7.5.0-RC.1
PrestaShop 1.7.5.1
PrestaShop 1.7.5.2
PrestaShop 1.7.6.0
PrestaShop 1.7.6.0 beta 1
PrestaShop 1.7.6.0 RC 1
PrestaShop 1.7.6.0 RC 2
PrestaShop 1.7.6.0-beta.1
PrestaShop 1.7.6.0-RC.1
PrestaShop 1.7.6.0-RC.2
PrestaShop 1.7.6.1
PrestaShop 1.7.6.2
PrestaShop 1.7.6.3
PrestaShop 1.7.6.4
PrestaShop 1.7.6.4 1
PrestaShop 1.7.6.5
PrestaShop 1.7.6.5 1

Adding permission check for admin order edits and legacy controller to prevent unauthenticated usage (3)

Skrevet den 26. oktober 202024. maj 2026 af i PrestaShop

Missing permission checks could lead to unauthorized usage in the admin section through the API.

This vulnerability affects the following application versions:

PrestaShop 1.7.0.0
PrestaShop 1.7.0.0 beta1
PrestaShop 1.7.0.0 beta2
PrestaShop 1.7.0.0 beta3
PrestaShop 1.7.0.0 RC0
PrestaShop 1.7.0.0 RC1
PrestaShop 1.7.0.0 RC2
PrestaShop 1.7.0.0 RC3
PrestaShop 1.7.0.1
PrestaShop 1.7.0.2
PrestaShop 1.7.0.3
PrestaShop 1.7.0.4
PrestaShop 1.7.0.5
PrestaShop 1.7.0.6
PrestaShop 1.7.1.0
PrestaShop 1.7.1.0 beta1
PrestaShop 1.7.1.1
PrestaShop 1.7.1.2
PrestaShop 1.7.2.0
PrestaShop 1.7.2.0 RC 1
PrestaShop 1.7.2.0-RC.1.0
PrestaShop 1.7.2.1
PrestaShop 1.7.2.2
PrestaShop 1.7.2.3
PrestaShop 1.7.2.4
PrestaShop 1.7.2.5
PrestaShop 1.7.3.0
PrestaShop 1.7.3.0 beta 1
PrestaShop 1.7.3.0 RC 1
PrestaShop 1.7.3.1
PrestaShop 1.7.3.2
PrestaShop 1.7.3.3
PrestaShop 1.7.3.4
PrestaShop 1.7.4.0
PrestaShop 1.7.4.0 beta 1
PrestaShop 1.7.4.1
PrestaShop 1.7.4.2
PrestaShop 1.7.4.3
PrestaShop 1.7.4.4
PrestaShop 1.7.5.0
PrestaShop 1.7.5.0 beta 1
PrestaShop 1.7.5.0 RC 1
PrestaShop 1.7.5.0-beta.1
PrestaShop 1.7.5.0-RC.1
PrestaShop 1.7.5.1
PrestaShop 1.7.5.2
PrestaShop 1.7.6.0
PrestaShop 1.7.6.0 beta 1
PrestaShop 1.7.6.0 RC 1
PrestaShop 1.7.6.0 RC 2
PrestaShop 1.7.6.0-beta.1
PrestaShop 1.7.6.0-RC.1
PrestaShop 1.7.6.0-RC.2
PrestaShop 1.7.6.1
PrestaShop 1.7.6.2
PrestaShop 1.7.6.3
PrestaShop 1.7.6.4
PrestaShop 1.7.6.4 1

Added escaping to the confirmation link to prevent XSS

Skrevet den 1. oktober 202024. maj 2026 af i PrestaShop

The onclick confirmation link wasn’t properly escaped against XSS.

This vulnerability affects the following application versions:

PrestaShop 1.6.0.1
PrestaShop 1.6.0.1 alpha 1
PrestaShop 1.6.0.2
PrestaShop 1.6.0.2 alpha 2
PrestaShop 1.6.0.3
PrestaShop 1.6.0.3 beta 1
PrestaShop 1.6.0.4
PrestaShop 1.6.0.4 RC1
PrestaShop 1.6.0.5
PrestaShop 1.6.0.6
PrestaShop 1.6.0.7
PrestaShop 1.6.0.8
PrestaShop 1.6.0.9
PrestaShop 1.6.0.10
PrestaShop 1.6.0.11
PrestaShop 1.6.0.12
PrestaShop 1.6.0.13
PrestaShop 1.6.0.14
PrestaShop 1.6.1.0
PrestaShop 1.6.1.0 RC4
PrestaShop 1.6.1.0 RC5
PrestaShop 1.6.1.1
PrestaShop 1.6.1.1 RC1
PrestaShop 1.6.1.1 RC2
PrestaShop 1.6.1.2
PrestaShop 1.6.1.2 RC1
PrestaShop 1.6.1.2 RC2
PrestaShop 1.6.1.2 RC3
PrestaShop 1.6.1.2 RC4
PrestaShop 1.6.1.3
PrestaShop 1.6.1.3 RC1
PrestaShop 1.6.1.4
PrestaShop 1.6.1.5
PrestaShop 1.6.1.6
PrestaShop 1.6.1.7
PrestaShop 1.6.1.8
PrestaShop 1.6.1.9
PrestaShop 1.6.1.10
PrestaShop 1.6.1.11
PrestaShop 1.6.1.11 beta 1
PrestaShop 1.6.1.11-beta.1.0
PrestaShop 1.6.1.12
PrestaShop 1.6.1.13
PrestaShop 1.6.1.14
PrestaShop 1.6.1.15
PrestaShop 1.6.1.16
PrestaShop 1.6.1.17
PrestaShop 1.6.1.18
PrestaShop 1.6.1.19
PrestaShop 1.6.1.20
PrestaShop 1.6.1.21
PrestaShop 1.6.1.22
PrestaShop 1.6.1.23
PrestaShop 1.6.1.24
PrestaShop 1.7.0.0
PrestaShop 1.7.0.0 beta1
PrestaShop 1.7.0.0 beta2
PrestaShop 1.7.0.0 beta3
PrestaShop 1.7.0.0 RC0
PrestaShop 1.7.0.0 RC1
PrestaShop 1.7.0.0 RC2
PrestaShop 1.7.0.0 RC3
PrestaShop 1.7.0.1
PrestaShop 1.7.0.2
PrestaShop 1.7.0.3
PrestaShop 1.7.0.4
PrestaShop 1.7.0.5
PrestaShop 1.7.0.6
PrestaShop 1.7.1.0
PrestaShop 1.7.1.0 beta1
PrestaShop 1.7.1.1
PrestaShop 1.7.1.2
PrestaShop 1.7.2.0
PrestaShop 1.7.2.0 RC 1
PrestaShop 1.7.2.0-RC.1.0
PrestaShop 1.7.2.1
PrestaShop 1.7.2.2
PrestaShop 1.7.2.3
PrestaShop 1.7.2.4
PrestaShop 1.7.2.5
PrestaShop 1.7.3.0
PrestaShop 1.7.3.0 beta 1
PrestaShop 1.7.3.0 RC 1
PrestaShop 1.7.3.1
PrestaShop 1.7.3.2
PrestaShop 1.7.3.3
PrestaShop 1.7.3.4
PrestaShop 1.7.4.0
PrestaShop 1.7.4.0 beta 1
PrestaShop 1.7.4.1
PrestaShop 1.7.4.2
PrestaShop 1.7.4.3
PrestaShop 1.7.4.4
PrestaShop 1.7.5.0
PrestaShop 1.7.5.0 beta 1
PrestaShop 1.7.5.0 RC 1
PrestaShop 1.7.5.0-beta.1
PrestaShop 1.7.5.0-RC.1
PrestaShop 1.7.5.1
PrestaShop 1.7.5.2
PrestaShop 1.7.6.0
PrestaShop 1.7.6.0 beta 1
PrestaShop 1.7.6.0 RC 1
PrestaShop 1.7.6.0 RC 2
PrestaShop 1.7.6.0-beta.1
PrestaShop 1.7.6.0-RC.1
PrestaShop 1.7.6.0-RC.2
PrestaShop 1.7.6.1
PrestaShop 1.7.6.2
PrestaShop 1.7.6.3
PrestaShop 1.7.6.4
PrestaShop 1.7.6.4 1
PrestaShop 1.7.6.5
PrestaShop 1.7.6.5 1

Open redirection when using back parameter (3)

Skrevet den 28. september 202024. maj 2026 af i PrestaShop

The impacts could be many, and vary from the theft of information and credentials to the redirection to malicious websites containing attacker-controlled content, which in some cases even caused XSS attacks. So even though an open redirection might sound harmless at first, the impacts of it could have been severe in case it was exploitable.

This vulnerability affects the following application versions:

PrestaShop 1.7.6.0
PrestaShop 1.7.6.0 RC 1
PrestaShop 1.7.6.0 RC 2
PrestaShop 1.7.6.0-RC.1
PrestaShop 1.7.6.0-RC.2
PrestaShop 1.7.6.1
PrestaShop 1.7.6.2
PrestaShop 1.7.6.3
PrestaShop 1.7.6.4
PrestaShop 1.7.6.4 1

Reflected XSS when uploading an image in the product page

Skrevet den 14. september 202024. maj 2026 af i PrestaShop

If a target sends a corrupted file, it leads to a reflected XSS.

This vulnerability affects the following application versions:

PrestaShop 1.7.0.0
PrestaShop 1.7.0.0 beta1
PrestaShop 1.7.0.0 beta2
PrestaShop 1.7.0.0 beta3
PrestaShop 1.7.0.0 RC0
PrestaShop 1.7.0.0 RC1
PrestaShop 1.7.0.0 RC2
PrestaShop 1.7.0.0 RC3
PrestaShop 1.7.0.1
PrestaShop 1.7.0.2
PrestaShop 1.7.0.3
PrestaShop 1.7.0.4
PrestaShop 1.7.0.5
PrestaShop 1.7.0.6
PrestaShop 1.7.1.0
PrestaShop 1.7.1.0 beta1
PrestaShop 1.7.1.1
PrestaShop 1.7.1.2
PrestaShop 1.7.2.0
PrestaShop 1.7.2.0 RC 1
PrestaShop 1.7.2.0-RC.1.0
PrestaShop 1.7.2.1
PrestaShop 1.7.2.2
PrestaShop 1.7.2.3
PrestaShop 1.7.2.4
PrestaShop 1.7.2.5
PrestaShop 1.7.3.0
PrestaShop 1.7.3.0 beta 1
PrestaShop 1.7.3.0 RC 1
PrestaShop 1.7.3.1
PrestaShop 1.7.3.2
PrestaShop 1.7.3.3
PrestaShop 1.7.3.4
PrestaShop 1.7.4.0
PrestaShop 1.7.4.0 beta 1
PrestaShop 1.7.4.1
PrestaShop 1.7.4.2
PrestaShop 1.7.4.3
PrestaShop 1.7.4.4
PrestaShop 1.7.5.0
PrestaShop 1.7.5.0 beta 1
PrestaShop 1.7.5.0 RC 1
PrestaShop 1.7.5.0-beta.1
PrestaShop 1.7.5.0-RC.1
PrestaShop 1.7.5.1
PrestaShop 1.7.5.2
PrestaShop 1.7.6.0
PrestaShop 1.7.6.0 beta 1
PrestaShop 1.7.6.0 RC 1
PrestaShop 1.7.6.0 RC 2
PrestaShop 1.7.6.0-beta.1
PrestaShop 1.7.6.0-RC.1
PrestaShop 1.7.6.0-RC.2
PrestaShop 1.7.6.1
PrestaShop 1.7.6.2
PrestaShop 1.7.6.3
PrestaShop 1.7.6.4
PrestaShop 1.7.6.4 1
PrestaShop 1.7.6.5
PrestaShop 1.7.6.5 1

Escaping added to extended exception message to avoid XSS

Skrevet den 2. juli 202024. maj 2026 af i PrestaShop

The extended exception message wasn’t properly escaped against XSS.

This vulnerability affects the following application versions:

PrestaShop 1.6.0.3
PrestaShop 1.6.0.3 beta 1
PrestaShop 1.6.0.4
PrestaShop 1.6.0.4 RC1
PrestaShop 1.6.0.5
PrestaShop 1.6.0.6
PrestaShop 1.6.0.7
PrestaShop 1.6.0.8
PrestaShop 1.6.0.9
PrestaShop 1.6.0.10
PrestaShop 1.6.0.11
PrestaShop 1.6.0.12
PrestaShop 1.6.0.13
PrestaShop 1.6.0.14
PrestaShop 1.6.1.0
PrestaShop 1.6.1.0 RC4
PrestaShop 1.6.1.0 RC5
PrestaShop 1.6.1.1
PrestaShop 1.6.1.1 RC1
PrestaShop 1.6.1.1 RC2
PrestaShop 1.6.1.2
PrestaShop 1.6.1.2 RC1
PrestaShop 1.6.1.2 RC2
PrestaShop 1.6.1.2 RC3
PrestaShop 1.6.1.2 RC4
PrestaShop 1.6.1.3
PrestaShop 1.6.1.3 RC1
PrestaShop 1.6.1.4
PrestaShop 1.6.1.5
PrestaShop 1.6.1.6
PrestaShop 1.6.1.7
PrestaShop 1.6.1.8
PrestaShop 1.6.1.9
PrestaShop 1.6.1.10
PrestaShop 1.6.1.11
PrestaShop 1.6.1.11 beta 1
PrestaShop 1.6.1.11-beta.1.0
PrestaShop 1.6.1.12
PrestaShop 1.6.1.13
PrestaShop 1.6.1.14
PrestaShop 1.6.1.15
PrestaShop 1.6.1.16
PrestaShop 1.6.1.17
PrestaShop 1.6.1.18
PrestaShop 1.6.1.19
PrestaShop 1.6.1.20
PrestaShop 1.6.1.21
PrestaShop 1.6.1.22
PrestaShop 1.6.1.23
PrestaShop 1.6.1.24
PrestaShop 1.7.0.0
PrestaShop 1.7.0.0 alpha3
PrestaShop 1.7.0.0 alpha4
PrestaShop 1.7.0.0 beta1
PrestaShop 1.7.0.0 beta2
PrestaShop 1.7.0.0 beta3
PrestaShop 1.7.0.0 RC0
PrestaShop 1.7.0.0 RC1
PrestaShop 1.7.0.0 RC2
PrestaShop 1.7.0.0 RC3
PrestaShop 1.7.0.1
PrestaShop 1.7.0.2
PrestaShop 1.7.0.3
PrestaShop 1.7.0.4
PrestaShop 1.7.0.5
PrestaShop 1.7.0.6
PrestaShop 1.7.1.0
PrestaShop 1.7.1.0 beta1
PrestaShop 1.7.1.1
PrestaShop 1.7.1.2
PrestaShop 1.7.2.0
PrestaShop 1.7.2.0 RC 1
PrestaShop 1.7.2.0-RC.1.0
PrestaShop 1.7.2.1
PrestaShop 1.7.2.2
PrestaShop 1.7.2.3
PrestaShop 1.7.2.4
PrestaShop 1.7.2.5
PrestaShop 1.7.3.0
PrestaShop 1.7.3.0 beta 1
PrestaShop 1.7.3.0 RC 1
PrestaShop 1.7.3.1
PrestaShop 1.7.3.2
PrestaShop 1.7.3.3
PrestaShop 1.7.3.4
PrestaShop 1.7.4.0
PrestaShop 1.7.4.0 beta 1
PrestaShop 1.7.4.1
PrestaShop 1.7.4.2
PrestaShop 1.7.4.3
PrestaShop 1.7.4.4
PrestaShop 1.7.5.0
PrestaShop 1.7.5.0 beta 1
PrestaShop 1.7.5.0 RC 1
PrestaShop 1.7.5.0-beta.1
PrestaShop 1.7.5.0-RC.1
PrestaShop 1.7.5.1
PrestaShop 1.7.5.2
PrestaShop 1.7.6.0
PrestaShop 1.7.6.0 beta 1
PrestaShop 1.7.6.0 RC 1
PrestaShop 1.7.6.0 RC 2
PrestaShop 1.7.6.0-beta.1
PrestaShop 1.7.6.0-RC.1
PrestaShop 1.7.6.0-RC.2
PrestaShop 1.7.6.1
PrestaShop 1.7.6.2
PrestaShop 1.7.6.3
PrestaShop 1.7.6.4
PrestaShop 1.7.6.4 1

Introducing type casting for ids to prevent XSS

Skrevet den 23. juni 202017. oktober 2026 af i PrestaShop

Always cast integer when it’s related to ids on AdminAttributesGroupsController to avoid XSS.

This vulnerability affects the following application versions:

PrestaShop 1.6.0.1
PrestaShop 1.6.0.1 alpha 1
PrestaShop 1.6.0.2
PrestaShop 1.6.0.2 alpha 2
PrestaShop 1.6.0.3
PrestaShop 1.6.0.3 beta 1
PrestaShop 1.6.0.4
PrestaShop 1.6.0.4 RC1
PrestaShop 1.6.0.5
PrestaShop 1.6.0.6
PrestaShop 1.6.0.7
PrestaShop 1.6.0.8
PrestaShop 1.6.0.9
PrestaShop 1.6.0.10
PrestaShop 1.6.0.11
PrestaShop 1.6.0.12
PrestaShop 1.6.0.13
PrestaShop 1.6.0.14
PrestaShop 1.6.1.0
PrestaShop 1.6.1.0 RC4
PrestaShop 1.6.1.0 RC5
PrestaShop 1.6.1.1
PrestaShop 1.6.1.1 RC1
PrestaShop 1.6.1.1 RC2
PrestaShop 1.6.1.2
PrestaShop 1.6.1.2 RC1
PrestaShop 1.6.1.2 RC2
PrestaShop 1.6.1.2 RC3
PrestaShop 1.6.1.2 RC4
PrestaShop 1.6.1.3
PrestaShop 1.6.1.3 RC1
PrestaShop 1.6.1.4
PrestaShop 1.6.1.5
PrestaShop 1.6.1.6
PrestaShop 1.6.1.7
PrestaShop 1.6.1.8
PrestaShop 1.6.1.9
PrestaShop 1.6.1.10
PrestaShop 1.6.1.11
PrestaShop 1.6.1.11 beta 1
PrestaShop 1.6.1.11-beta.1.0
PrestaShop 1.6.1.12
PrestaShop 1.6.1.13
PrestaShop 1.6.1.14
PrestaShop 1.6.1.15
PrestaShop 1.6.1.16
PrestaShop 1.6.1.17
PrestaShop 1.6.1.18
PrestaShop 1.6.1.19
PrestaShop 1.6.1.20
PrestaShop 1.6.1.21
PrestaShop 1.6.1.22
PrestaShop 1.6.1.23
PrestaShop 1.6.1.24
PrestaShop 1.7.0.0
PrestaShop 1.7.0.0 alpha3
PrestaShop 1.7.0.0 alpha4
PrestaShop 1.7.0.0 beta1
PrestaShop 1.7.0.0 beta2
PrestaShop 1.7.0.0 beta3
PrestaShop 1.7.0.0 RC0
PrestaShop 1.7.0.0 RC1
PrestaShop 1.7.0.0 RC2
PrestaShop 1.7.0.0 RC3
PrestaShop 1.7.0.1
PrestaShop 1.7.0.2
PrestaShop 1.7.0.3
PrestaShop 1.7.0.4
PrestaShop 1.7.0.5
PrestaShop 1.7.0.6
PrestaShop 1.7.1.0
PrestaShop 1.7.1.0 beta1
PrestaShop 1.7.1.1
PrestaShop 1.7.1.2
PrestaShop 1.7.2.0
PrestaShop 1.7.2.0 RC 1
PrestaShop 1.7.2.0-RC.1.0
PrestaShop 1.7.2.1
PrestaShop 1.7.2.2
PrestaShop 1.7.2.3
PrestaShop 1.7.2.4
PrestaShop 1.7.2.5
PrestaShop 1.7.3.0
PrestaShop 1.7.3.0 beta 1
PrestaShop 1.7.3.0 RC 1
PrestaShop 1.7.3.1
PrestaShop 1.7.3.2
PrestaShop 1.7.3.3
PrestaShop 1.7.3.4
PrestaShop 1.7.4.0
PrestaShop 1.7.4.0 beta 1
PrestaShop 1.7.4.1
PrestaShop 1.7.4.2
PrestaShop 1.7.4.3
PrestaShop 1.7.4.4
PrestaShop 1.7.5.0
PrestaShop 1.7.5.0 beta 1
PrestaShop 1.7.5.0 RC 1
PrestaShop 1.7.5.0-beta.1
PrestaShop 1.7.5.0-RC.1
PrestaShop 1.7.5.1
PrestaShop 1.7.5.2
PrestaShop 1.7.6.0
PrestaShop 1.7.6.0 beta 1
PrestaShop 1.7.6.0 RC 1
PrestaShop 1.7.6.0 RC 2
PrestaShop 1.7.6.0-beta.1
PrestaShop 1.7.6.0-RC.1
PrestaShop 1.7.6.0-RC.2
PrestaShop 1.7.6.1
PrestaShop 1.7.6.2
PrestaShop 1.7.6.3
PrestaShop 1.7.6.4
PrestaShop 1.7.6.4 1

Added permission check for loading cart rules to prevent unauthorized access

Skrevet den 10. juni 202024. maj 2026 af i PrestaShop

Permission access was not properly checked to access loading cart rules.

This vulnerability affects the following application versions:

PrestaShop 1.7.0.0
PrestaShop 1.7.0.0 beta1
PrestaShop 1.7.0.0 beta2
PrestaShop 1.7.0.0 beta3
PrestaShop 1.7.0.0 RC0
PrestaShop 1.7.0.0 RC1
PrestaShop 1.7.0.0 RC2
PrestaShop 1.7.0.0 RC3
PrestaShop 1.7.0.1
PrestaShop 1.7.0.2
PrestaShop 1.7.0.3
PrestaShop 1.7.0.4
PrestaShop 1.7.0.5
PrestaShop 1.7.0.6
PrestaShop 1.7.1.0
PrestaShop 1.7.1.0 beta1
PrestaShop 1.7.1.1
PrestaShop 1.7.1.2
PrestaShop 1.7.2.0
PrestaShop 1.7.2.0 RC 1
PrestaShop 1.7.2.0-RC.1.0
PrestaShop 1.7.2.1
PrestaShop 1.7.2.2
PrestaShop 1.7.2.3
PrestaShop 1.7.2.4
PrestaShop 1.7.2.5
PrestaShop 1.7.3.0
PrestaShop 1.7.3.0 beta 1
PrestaShop 1.7.3.0 RC 1
PrestaShop 1.7.3.1
PrestaShop 1.7.3.2
PrestaShop 1.7.3.3
PrestaShop 1.7.3.4
PrestaShop 1.7.4.0
PrestaShop 1.7.4.0 beta 1
PrestaShop 1.7.4.1
PrestaShop 1.7.4.2
PrestaShop 1.7.4.3
PrestaShop 1.7.4.4
PrestaShop 1.7.5.0
PrestaShop 1.7.5.0 beta 1
PrestaShop 1.7.5.0 RC 1
PrestaShop 1.7.5.0-beta.1
PrestaShop 1.7.5.0-RC.1
PrestaShop 1.7.5.1
PrestaShop 1.7.5.2
PrestaShop 1.7.6.0
PrestaShop 1.7.6.0 beta 1
PrestaShop 1.7.6.0 RC 1
PrestaShop 1.7.6.0 RC 2
PrestaShop 1.7.6.0-beta.1
PrestaShop 1.7.6.0-RC.1
PrestaShop 1.7.6.0-RC.2
PrestaShop 1.7.6.1
PrestaShop 1.7.6.2
PrestaShop 1.7.6.3
PrestaShop 1.7.6.4
PrestaShop 1.7.6.4 1

Escaping added for safe output to prevent XSS

Skrevet den 10. juni 202024. maj 2026 af i PrestaShop

The search page with alias and search parameters outputs was not properly escaped to prevent XSS.

This vulnerability affects the following application versions:

PrestaShop 1.7.0.0
PrestaShop 1.7.0.0 beta1
PrestaShop 1.7.0.0 beta2
PrestaShop 1.7.0.0 beta3
PrestaShop 1.7.0.0 RC0
PrestaShop 1.7.0.0 RC1
PrestaShop 1.7.0.0 RC2
PrestaShop 1.7.0.0 RC3
PrestaShop 1.7.0.1
PrestaShop 1.7.0.2
PrestaShop 1.7.0.3
PrestaShop 1.7.0.4
PrestaShop 1.7.0.5
PrestaShop 1.7.0.6
PrestaShop 1.7.1.0
PrestaShop 1.7.1.0 beta1
PrestaShop 1.7.1.1
PrestaShop 1.7.1.2
PrestaShop 1.7.2.0
PrestaShop 1.7.2.0 RC 1
PrestaShop 1.7.2.0-RC.1.0
PrestaShop 1.7.2.1
PrestaShop 1.7.2.2
PrestaShop 1.7.2.3
PrestaShop 1.7.2.4
PrestaShop 1.7.2.5
PrestaShop 1.7.3.0
PrestaShop 1.7.3.0 beta 1
PrestaShop 1.7.3.0 RC 1
PrestaShop 1.7.3.1
PrestaShop 1.7.3.2
PrestaShop 1.7.3.3
PrestaShop 1.7.3.4
PrestaShop 1.7.4.0
PrestaShop 1.7.4.0 beta 1
PrestaShop 1.7.4.1
PrestaShop 1.7.4.2
PrestaShop 1.7.4.3
PrestaShop 1.7.4.4
PrestaShop 1.7.5.0
PrestaShop 1.7.5.0 beta 1
PrestaShop 1.7.5.0 RC 1
PrestaShop 1.7.5.0-beta.1
PrestaShop 1.7.5.0-RC.1
PrestaShop 1.7.5.1
PrestaShop 1.7.5.2
PrestaShop 1.7.6.0
PrestaShop 1.7.6.0 beta 1
PrestaShop 1.7.6.0 RC 1
PrestaShop 1.7.6.0 RC 2
PrestaShop 1.7.6.0-beta.1
PrestaShop 1.7.6.0-RC.1
PrestaShop 1.7.6.0-RC.2
PrestaShop 1.7.6.1
PrestaShop 1.7.6.2
PrestaShop 1.7.6.3
PrestaShop 1.7.6.4
PrestaShop 1.7.6.4 1

Introducing type casting in admin feature controller to avoid XSS

Skrevet den 10. juni 202024. maj 2026 af i PrestaShop

id_feature Parameter was not properly escaped against XSS.

This vulnerability affects the following application versions:

PrestaShop 1.7.0.0
PrestaShop 1.7.0.0 beta1
PrestaShop 1.7.0.0 beta2
PrestaShop 1.7.0.0 beta3
PrestaShop 1.7.0.0 RC0
PrestaShop 1.7.0.0 RC1
PrestaShop 1.7.0.0 RC2
PrestaShop 1.7.0.0 RC3
PrestaShop 1.7.0.1
PrestaShop 1.7.0.2
PrestaShop 1.7.0.3
PrestaShop 1.7.0.4
PrestaShop 1.7.0.5
PrestaShop 1.7.0.6
PrestaShop 1.7.1.0
PrestaShop 1.7.1.0 beta1
PrestaShop 1.7.1.1
PrestaShop 1.7.1.2
PrestaShop 1.7.2.0
PrestaShop 1.7.2.0 RC 1
PrestaShop 1.7.2.0-RC.1.0
PrestaShop 1.7.2.1
PrestaShop 1.7.2.2
PrestaShop 1.7.2.3
PrestaShop 1.7.2.4
PrestaShop 1.7.2.5
PrestaShop 1.7.3.0
PrestaShop 1.7.3.0 beta 1
PrestaShop 1.7.3.0 RC 1
PrestaShop 1.7.3.1
PrestaShop 1.7.3.2
PrestaShop 1.7.3.3
PrestaShop 1.7.3.4
PrestaShop 1.7.4.0
PrestaShop 1.7.4.0 beta 1
PrestaShop 1.7.4.1
PrestaShop 1.7.4.2
PrestaShop 1.7.4.3
PrestaShop 1.7.4.4
PrestaShop 1.7.5.0
PrestaShop 1.7.5.0 beta 1
PrestaShop 1.7.5.0 RC 1
PrestaShop 1.7.5.0-beta.1
PrestaShop 1.7.5.0-RC.1
PrestaShop 1.7.5.1
PrestaShop 1.7.5.2
PrestaShop 1.7.6.0
PrestaShop 1.7.6.0 beta 1
PrestaShop 1.7.6.0 RC 1
PrestaShop 1.7.6.0 RC 2
PrestaShop 1.7.6.0-beta.1
PrestaShop 1.7.6.0-RC.1
PrestaShop 1.7.6.0-RC.2
PrestaShop 1.7.6.1
PrestaShop 1.7.6.2
PrestaShop 1.7.6.3
PrestaShop 1.7.6.4
PrestaShop 1.7.6.4 1

Limit file name to text to prevent XSS

Skrevet den 20. maj 202024. maj 2026 af i PrestaShop

Reflected XSS when uploading a wrong file.

This vulnerability affects the following application versions:

PrestaShop 1.7.4.0
PrestaShop 1.7.4.0 beta 1
PrestaShop 1.7.4.1
PrestaShop 1.7.4.2
PrestaShop 1.7.4.3
PrestaShop 1.7.4.4
PrestaShop 1.7.5.0
PrestaShop 1.7.5.0 beta 1
PrestaShop 1.7.5.0 RC 1
PrestaShop 1.7.5.0-beta.1
PrestaShop 1.7.5.0-RC.1
PrestaShop 1.7.5.1
PrestaShop 1.7.5.2
PrestaShop 1.7.6.0
PrestaShop 1.7.6.0 beta 1
PrestaShop 1.7.6.0 RC 1
PrestaShop 1.7.6.0 RC 2
PrestaShop 1.7.6.0-beta.1
PrestaShop 1.7.6.0-RC.1
PrestaShop 1.7.6.0-RC.2
PrestaShop 1.7.6.1
PrestaShop 1.7.6.2
PrestaShop 1.7.6.3
PrestaShop 1.7.6.4
PrestaShop 1.7.6.4 1

Possible information steal

Skrevet den 18. marts 202024. maj 2026 af i PrestaShop

When a customer edits their address, they can freely change the id_address in the form, and thus steal someone else’s address. It’s the same with CustomerForm, you’re able to change the id_customer and change all information of all accounts.

CVE-2020-5250

This vulnerability affects the following application versions:

PrestaShop 1.7.0.0
PrestaShop 1.7.0.0 beta1
PrestaShop 1.7.0.0 beta2
PrestaShop 1.7.0.0 beta3
PrestaShop 1.7.0.0 RC0
PrestaShop 1.7.0.0 RC1
PrestaShop 1.7.0.0 RC2
PrestaShop 1.7.0.0 RC3
PrestaShop 1.7.0.1
PrestaShop 1.7.0.2
PrestaShop 1.7.0.3
PrestaShop 1.7.0.4
PrestaShop 1.7.0.5
PrestaShop 1.7.0.6
PrestaShop 1.7.1.0
PrestaShop 1.7.1.0 beta1
PrestaShop 1.7.1.1
PrestaShop 1.7.1.2
PrestaShop 1.7.2.0
PrestaShop 1.7.2.0 RC 1
PrestaShop 1.7.2.0-RC.1.0
PrestaShop 1.7.2.1
PrestaShop 1.7.2.2
PrestaShop 1.7.2.3
PrestaShop 1.7.2.4
PrestaShop 1.7.2.5
PrestaShop 1.7.3.0
PrestaShop 1.7.3.0 beta 1
PrestaShop 1.7.3.0 RC 1
PrestaShop 1.7.3.1
PrestaShop 1.7.3.2
PrestaShop 1.7.3.3
PrestaShop 1.7.3.4
PrestaShop 1.7.4.0
PrestaShop 1.7.4.0 beta 1
PrestaShop 1.7.4.1
PrestaShop 1.7.4.2
PrestaShop 1.7.4.3
PrestaShop 1.7.4.4
PrestaShop 1.7.5.0
PrestaShop 1.7.5.0 beta 1
PrestaShop 1.7.5.0 RC 1
PrestaShop 1.7.5.0-beta.1
PrestaShop 1.7.5.0-RC.1
PrestaShop 1.7.5.1
PrestaShop 1.7.5.2
PrestaShop 1.7.6.0
PrestaShop 1.7.6.0 beta 1
PrestaShop 1.7.6.0 RC 1
PrestaShop 1.7.6.0 RC 2
PrestaShop 1.7.6.0-beta.1
PrestaShop 1.7.6.0-RC.1
PrestaShop 1.7.6.0-RC.2
PrestaShop 1.7.6.1
PrestaShop 1.7.6.2
PrestaShop 1.7.6.3

Strengthening secret key and check password hash

Skrevet den 3. september 201924. maj 2026 af i PrestaShop

The secret key for the customer wasn’t that strong and customer’s password was not checked since login.

This vulnerability affects the following application versions:

PrestaShop 1.6.0.3
PrestaShop 1.6.0.3 beta 1
PrestaShop 1.6.0.4
PrestaShop 1.6.0.4 RC1
PrestaShop 1.6.0.5
PrestaShop 1.6.0.6
PrestaShop 1.6.0.7
PrestaShop 1.6.0.8
PrestaShop 1.6.0.9
PrestaShop 1.6.0.10
PrestaShop 1.6.0.11
PrestaShop 1.6.0.12
PrestaShop 1.6.0.13
PrestaShop 1.6.0.14
PrestaShop 1.6.1.0
PrestaShop 1.6.1.0 RC4
PrestaShop 1.6.1.0 RC5
PrestaShop 1.6.1.1
PrestaShop 1.6.1.1 RC1
PrestaShop 1.6.1.1 RC2
PrestaShop 1.6.1.2
PrestaShop 1.6.1.2 RC1
PrestaShop 1.6.1.2 RC2
PrestaShop 1.6.1.2 RC3
PrestaShop 1.6.1.2 RC4
PrestaShop 1.6.1.3
PrestaShop 1.6.1.3 RC1
PrestaShop 1.6.1.4
PrestaShop 1.6.1.5
PrestaShop 1.6.1.6
PrestaShop 1.6.1.7
PrestaShop 1.6.1.8
PrestaShop 1.6.1.9
PrestaShop 1.6.1.10
PrestaShop 1.6.1.11
PrestaShop 1.6.1.11 beta 1
PrestaShop 1.6.1.11-beta.1.0
PrestaShop 1.6.1.12
PrestaShop 1.6.1.13
PrestaShop 1.6.1.14
PrestaShop 1.6.1.15
PrestaShop 1.6.1.16
PrestaShop 1.6.1.17
PrestaShop 1.6.1.18
PrestaShop 1.6.1.19
PrestaShop 1.6.1.20
PrestaShop 1.6.1.21
PrestaShop 1.6.1.22
PrestaShop 1.6.1.23
PrestaShop 1.6.1.24
PrestaShop 1.7.0.0
PrestaShop 1.7.0.0 alpha3
PrestaShop 1.7.0.0 alpha4
PrestaShop 1.7.0.0 beta1
PrestaShop 1.7.0.0 beta2
PrestaShop 1.7.0.0 beta3
PrestaShop 1.7.0.0 RC0
PrestaShop 1.7.0.0 RC1
PrestaShop 1.7.0.0 RC2
PrestaShop 1.7.0.0 RC3
PrestaShop 1.7.0.1
PrestaShop 1.7.0.2
PrestaShop 1.7.0.3
PrestaShop 1.7.0.4
PrestaShop 1.7.0.5
PrestaShop 1.7.0.6
PrestaShop 1.7.1.0
PrestaShop 1.7.1.0 beta1
PrestaShop 1.7.1.1
PrestaShop 1.7.1.2
PrestaShop 1.7.2.0
PrestaShop 1.7.2.0 RC 1
PrestaShop 1.7.2.0-RC.1.0
PrestaShop 1.7.2.1
PrestaShop 1.7.2.2
PrestaShop 1.7.2.3
PrestaShop 1.7.2.4
PrestaShop 1.7.2.5
PrestaShop 1.7.3.0
PrestaShop 1.7.3.0 beta 1
PrestaShop 1.7.3.0 RC 1
PrestaShop 1.7.3.1
PrestaShop 1.7.3.2
PrestaShop 1.7.3.3
PrestaShop 1.7.3.4
PrestaShop 1.7.4.0
PrestaShop 1.7.4.0 beta 1
PrestaShop 1.7.4.1
PrestaShop 1.7.4.2
PrestaShop 1.7.4.3
PrestaShop 1.7.4.4
PrestaShop 1.7.5.0
PrestaShop 1.7.5.0 beta 1
PrestaShop 1.7.5.0 RC 1
PrestaShop 1.7.5.0-beta.1
PrestaShop 1.7.5.0-RC.1
PrestaShop 1.7.5.1
PrestaShop 1.7.5.2

Added escaping to the templates to avoid XSS

Skrevet den 11. juni 201924. maj 2026 af i PrestaShop

The admin templates were not properly sanitized which could result in an XSS attack.

This vulnerability affects the following application versions:

PrestaShop 1.6.0.12
PrestaShop 1.6.0.13
PrestaShop 1.6.0.14
PrestaShop 1.6.1.0
PrestaShop 1.6.1.0 RC4
PrestaShop 1.6.1.0 RC5
PrestaShop 1.6.1.1
PrestaShop 1.6.1.1 RC1
PrestaShop 1.6.1.1 RC2
PrestaShop 1.6.1.2
PrestaShop 1.6.1.2 RC1
PrestaShop 1.6.1.2 RC2
PrestaShop 1.6.1.2 RC3
PrestaShop 1.6.1.2 RC4
PrestaShop 1.6.1.3
PrestaShop 1.6.1.3 RC1
PrestaShop 1.6.1.4
PrestaShop 1.6.1.5
PrestaShop 1.6.1.6
PrestaShop 1.6.1.7
PrestaShop 1.6.1.8
PrestaShop 1.6.1.9
PrestaShop 1.6.1.10
PrestaShop 1.6.1.11
PrestaShop 1.6.1.11 beta 1
PrestaShop 1.6.1.11-beta.1.0
PrestaShop 1.6.1.12
PrestaShop 1.6.1.13
PrestaShop 1.6.1.14
PrestaShop 1.6.1.15
PrestaShop 1.6.1.16
PrestaShop 1.6.1.17
PrestaShop 1.6.1.18
PrestaShop 1.6.1.19
PrestaShop 1.6.1.20
PrestaShop 1.6.1.21
PrestaShop 1.6.1.22
PrestaShop 1.6.1.23
PrestaShop 1.6.1.24
PrestaShop 1.7.0.0
PrestaShop 1.7.0.0 beta1
PrestaShop 1.7.0.0 beta2
PrestaShop 1.7.0.0 beta3
PrestaShop 1.7.0.0 RC0
PrestaShop 1.7.0.0 RC1
PrestaShop 1.7.0.0 RC2
PrestaShop 1.7.0.0 RC3
PrestaShop 1.7.0.1
PrestaShop 1.7.0.2
PrestaShop 1.7.0.3
PrestaShop 1.7.0.4
PrestaShop 1.7.0.5
PrestaShop 1.7.0.6
PrestaShop 1.7.1.0
PrestaShop 1.7.1.0 beta1
PrestaShop 1.7.1.1
PrestaShop 1.7.1.2
PrestaShop 1.7.2.0
PrestaShop 1.7.2.0 RC 1
PrestaShop 1.7.2.0-RC.1.0
PrestaShop 1.7.2.1
PrestaShop 1.7.2.2
PrestaShop 1.7.2.3
PrestaShop 1.7.2.4
PrestaShop 1.7.2.5
PrestaShop 1.7.3.0
PrestaShop 1.7.3.0 beta 1
PrestaShop 1.7.3.0 RC 1
PrestaShop 1.7.3.1
PrestaShop 1.7.3.2
PrestaShop 1.7.3.3
PrestaShop 1.7.3.4
PrestaShop 1.7.4.0
PrestaShop 1.7.4.0 beta 1
PrestaShop 1.7.4.1
PrestaShop 1.7.4.2
PrestaShop 1.7.4.3
PrestaShop 1.7.4.4
PrestaShop 1.7.5.0 beta 1
PrestaShop 1.7.5.0-beta.1

Fix filemanager security breaches and extra file type check

Skrevet den 16. januar 201924. maj 2026 af i PrestaShop

Fix security breaches in TinyMCE filemanager plugin. Remove filemanager action image_size. Check mime type when uploading files. Fixed arbitrary image write/overwrite in Windows installation. Prevent image directory deletion.

This vulnerability affects the following application versions:

PrestaShop 1.6.0.4
PrestaShop 1.6.0.4 RC1
PrestaShop 1.6.0.5
PrestaShop 1.6.0.6
PrestaShop 1.6.0.7
PrestaShop 1.6.0.8
PrestaShop 1.6.0.9
PrestaShop 1.6.0.10
PrestaShop 1.6.0.11
PrestaShop 1.6.0.12
PrestaShop 1.6.0.13
PrestaShop 1.6.0.14
PrestaShop 1.6.1.0
PrestaShop 1.6.1.0 RC4
PrestaShop 1.6.1.0 RC5
PrestaShop 1.6.1.1
PrestaShop 1.6.1.1 RC1
PrestaShop 1.6.1.1 RC2
PrestaShop 1.6.1.2
PrestaShop 1.6.1.2 RC1
PrestaShop 1.6.1.2 RC2
PrestaShop 1.6.1.2 RC3
PrestaShop 1.6.1.2 RC4
PrestaShop 1.6.1.3
PrestaShop 1.6.1.3 RC1
PrestaShop 1.6.1.4
PrestaShop 1.6.1.5
PrestaShop 1.6.1.6
PrestaShop 1.6.1.7
PrestaShop 1.6.1.8
PrestaShop 1.6.1.9
PrestaShop 1.6.1.10
PrestaShop 1.6.1.11
PrestaShop 1.6.1.11 beta 1
PrestaShop 1.6.1.11-beta.1.0
PrestaShop 1.6.1.12
PrestaShop 1.6.1.13
PrestaShop 1.6.1.14
PrestaShop 1.6.1.15
PrestaShop 1.6.1.16
PrestaShop 1.6.1.17
PrestaShop 1.6.1.18
PrestaShop 1.6.1.19
PrestaShop 1.6.1.20
PrestaShop 1.6.1.21
PrestaShop 1.6.1.22
PrestaShop 1.7.0.0
PrestaShop 1.7.0.0 alpha3
PrestaShop 1.7.0.0 alpha4
PrestaShop 1.7.0.0 beta1
PrestaShop 1.7.0.0 beta2
PrestaShop 1.7.0.0 beta3
PrestaShop 1.7.0.0 RC0
PrestaShop 1.7.0.0 RC1
PrestaShop 1.7.0.0 RC2
PrestaShop 1.7.0.0 RC3
PrestaShop 1.7.0.1
PrestaShop 1.7.0.2
PrestaShop 1.7.0.3
PrestaShop 1.7.0.4
PrestaShop 1.7.0.5
PrestaShop 1.7.0.6
PrestaShop 1.7.1.0
PrestaShop 1.7.1.0 beta1
PrestaShop 1.7.1.1
PrestaShop 1.7.1.2
PrestaShop 1.7.2.0
PrestaShop 1.7.2.0 RC 1
PrestaShop 1.7.2.0-RC.1.0
PrestaShop 1.7.2.1
PrestaShop 1.7.2.2
PrestaShop 1.7.2.3
PrestaShop 1.7.2.4
PrestaShop 1.7.2.5
PrestaShop 1.7.3.0
PrestaShop 1.7.3.0 beta 1
PrestaShop 1.7.3.0 RC 1
PrestaShop 1.7.3.1
PrestaShop 1.7.3.2
PrestaShop 1.7.3.3
PrestaShop 1.7.3.4
PrestaShop 1.7.4.0
PrestaShop 1.7.4.0 beta 1
PrestaShop 1.7.4.1
PrestaShop 1.7.4.2
PrestaShop 1.7.4.3
PHPFusion 8.00.19

Wrong parameter verification, allowing redirection to arbitrary URL

Skrevet den 8. oktober 201824. maj 2026 af i PrestaShop

Official description: A wrongly verified parameter allowed redirection to an external URL.

This vulnerability affects the following application versions:

PrestaShop 1.7.2.0
PrestaShop 1.7.2.0 RC 1
PrestaShop 1.7.2.0-RC.1.0
PrestaShop 1.7.2.1
PrestaShop 1.7.2.2
PrestaShop 1.7.2.3
PrestaShop 1.7.2.4
PrestaShop 1.7.2.5
PrestaShop 1.7.3.0
PrestaShop 1.7.3.0 beta 1
PrestaShop 1.7.3.0 RC 1
PrestaShop 1.7.3.1
PrestaShop 1.7.3.2
PrestaShop 1.7.3.3
PrestaShop 1.7.3.4

Adding permission levels for theme editing

Skrevet den 27. september 201820. november 2024 af i PrestaShop

Official description: Reduced permission levels for theme edition

This vulnerability affects the following application versions:

PrestaShop 1.7.3.1
PrestaShop 1.7.3.2
PrestaShop 1.7.3.3
PrestaShop 1.7.3.4

Improve cookie encryption

Skrevet den 25. september 201824. maj 2026 af i PrestaShop

Official description: Improved cookie encryption.

This vulnerability affects the following application versions:

PrestaShop 1.7.0.0
PrestaShop 1.7.0.0 beta1
PrestaShop 1.7.0.0 beta2
PrestaShop 1.7.0.0 beta3
PrestaShop 1.7.0.0 RC0
PrestaShop 1.7.0.0 RC1
PrestaShop 1.7.0.0 RC2
PrestaShop 1.7.0.0 RC3
PrestaShop 1.7.0.1
PrestaShop 1.7.0.2
PrestaShop 1.7.0.3
PrestaShop 1.7.0.4
PrestaShop 1.7.0.5
PrestaShop 1.7.0.6
PrestaShop 1.7.1.0
PrestaShop 1.7.1.0 beta1
PrestaShop 1.7.1.1
PrestaShop 1.7.1.2
PrestaShop 1.7.2.0
PrestaShop 1.7.2.0 RC 1
PrestaShop 1.7.2.0-RC.1.0
PrestaShop 1.7.2.1
PrestaShop 1.7.2.2
PrestaShop 1.7.2.3
PrestaShop 1.7.2.4
PrestaShop 1.7.2.5
PrestaShop 1.7.3.0
PrestaShop 1.7.3.0 beta 1
PrestaShop 1.7.3.0 RC 1
PrestaShop 1.7.3.1
PrestaShop 1.7.3.2
PrestaShop 1.7.3.3

[7069/7190] Protect translations display from XSS injections

Skrevet den 9. april 201820. november 2024 af i PrestaShop

Official description: #7069 Protect translations display against XSS injections / #7190 Escape translated strings to prevent XSS

This vulnerability affects the following application versions:

PrestaShop 1.7.0.0
PrestaShop 1.7.0.0 beta1
PrestaShop 1.7.0.0 beta2
PrestaShop 1.7.0.0 beta3
PrestaShop 1.7.0.0 RC0
PrestaShop 1.7.0.0 RC1
PrestaShop 1.7.0.0 RC2
PrestaShop 1.7.0.0 RC3
PrestaShop 1.7.0.1

[8381] Remove risky and useless sprintf() calls

Skrevet den 9. april 201824. maj 2026 af i PrestaShop

Official description: CO: improvement, We often receive issues regarding translation, and the concerned translations always have a call to sprintf(). The new function trans() is already able to replace the placeholders without throwing fatal errors in case of errors. So this PR removes all calls to sprintf where trans can be used alone.

This vulnerability affects the following application versions:

PrestaShop 1.7.0.0
PrestaShop 1.7.0.0 beta1
PrestaShop 1.7.0.0 beta2
PrestaShop 1.7.0.0 beta3
PrestaShop 1.7.0.0 RC0
PrestaShop 1.7.0.0 RC1
PrestaShop 1.7.0.0 RC2
PrestaShop 1.7.0.0 RC3
PrestaShop 1.7.0.1
PrestaShop 1.7.0.2
PrestaShop 1.7.0.3
PrestaShop 1.7.0.4
PrestaShop 1.7.0.5
PrestaShop 1.7.0.6
PrestaShop 1.7.1.0
PrestaShop 1.7.1.0 beta1
PrestaShop 1.7.1.1
PrestaShop 1.7.1.2
PrestaShop 1.7.2.0
PrestaShop 1.7.2.0 RC 1
PrestaShop 1.7.2.0-RC.1.0
PrestaShop 1.7.2.1
PrestaShop 1.7.2.2
PrestaShop 1.7.2.3
PrestaShop 1.7.2.4
PrestaShop 1.7.2.5

[PSCFV-11936] Escape HTML char for Return Message

Skrevet den 28. marts 201818. oktober 2025 af i PrestaShop

Official description: BO : Bug #PSCFV-11936, Escape HTML char for Return Message

This vulnerability affects the following application versions:

PrestaShop 1.5.5.0
PrestaShop 1.5.6.0
PrestaShop 1.5.6.1
PrestaShop 1.5.6.2
PrestaShop 1.6.0.1
PrestaShop 1.6.0.1 alpha 1
PrestaShop 1.6.0.2
PrestaShop 1.6.0.2 alpha 2
PrestaShop 1.6.0.3
PrestaShop 1.6.0.3 beta 1
PrestaShop 1.6.0.4
PrestaShop 1.6.0.4 RC1
PrestaShop 1.6.0.5
PrestaShop 1.6.0.6

[PSCSX-4841] Using for encryption CBC mode instead of ECB

Skrevet den 28. marts 201818. oktober 2025 af i PrestaShop

Official description: SECURITY : (cc49345) Fixes PSCSX-4841 Usage of ECB mode

This vulnerability affects the following application versions:

PrestaShop 1.5.4.0
PrestaShop 1.5.4.1
PrestaShop 1.5.5.0
PrestaShop 1.5.6.0
PrestaShop 1.5.6.1
PrestaShop 1.5.6.2
PrestaShop 1.5.6.3
PrestaShop 1.6.0.1
PrestaShop 1.6.0.1 alpha 1
PrestaShop 1.6.0.2
PrestaShop 1.6.0.2 alpha 2
PrestaShop 1.6.0.3
PrestaShop 1.6.0.3 beta 1
PrestaShop 1.6.0.4
PrestaShop 1.6.0.4 RC1
PrestaShop 1.6.0.5
PrestaShop 1.6.0.6
PrestaShop 1.6.0.7
PrestaShop 1.6.0.8
PrestaShop 1.6.0.9
PrestaShop 1.6.0.10
PrestaShop 1.6.0.11
PrestaShop 1.6.0.12
PrestaShop 1.6.0.13
PrestaShop 1.6.0.14
PrestaShop 1.6.1.0
PrestaShop 1.6.1.0 RC4
PrestaShop 1.6.1.0 RC5
PrestaShop 1.6.1.1
PrestaShop 1.6.1.1 RC1
PrestaShop 1.6.1.1 RC2
PrestaShop 1.6.1.2
PrestaShop 1.6.1.2 RC1
PrestaShop 1.6.1.2 RC2
PrestaShop 1.6.1.2 RC3
PrestaShop 1.6.1.2 RC4
PrestaShop 1.6.1.3
PrestaShop 1.6.1.3 RC1
PrestaShop 1.6.1.4

[2104] Bcc in Mail::Send was not checked for vaild e-mail

Skrevet den 28. marts 2018 af i PrestaShop

Official description: BO: Bcc in Mail::Send was not check for vaild e-mail #2104

This vulnerability affects the following application versions:

PrestaShop 1.5.6.1
PrestaShop 1.6.0.1
PrestaShop 1.6.0.1 alpha 1
PrestaShop 1.6.0.2
PrestaShop 1.6.0.2 alpha 2
PrestaShop 1.6.0.3
PrestaShop 1.6.0.3 beta 1
PrestaShop 1.6.0.4
PrestaShop 1.6.0.4 RC1
PrestaShop 1.6.0.5
PrestaShop 1.6.0.6
PrestaShop 1.6.0.7
PrestaShop 1.6.0.8
PrestaShop 1.6.0.9
PrestaShop 1.6.0.10
PrestaShop 1.6.0.11

[PSCSX-9597] Hide the password in the confirmation email

Skrevet den 28. marts 201824. maj 2026 af i PrestaShop

Official description: FO: bug#PSCSX-9597, When customers sign up, they receive their password in plain text in the confirmation email, but these must be hidden.

This vulnerability affects the following application versions:

PrestaShop 1.6.0.1
PrestaShop 1.6.0.1 alpha 1
PrestaShop 1.6.0.2
PrestaShop 1.6.0.2 alpha 2
PrestaShop 1.6.0.3
PrestaShop 1.6.0.3 beta 1
PrestaShop 1.6.0.4
PrestaShop 1.6.0.4 RC1
PrestaShop 1.6.0.5
PrestaShop 1.6.0.6
PrestaShop 1.6.0.7
PrestaShop 1.6.0.8
PrestaShop 1.6.0.9
PrestaShop 1.6.0.11
PrestaShop 1.6.0.12
PrestaShop 1.6.0.13
PrestaShop 1.6.0.14
PrestaShop 1.6.1.0
PrestaShop 1.6.1.0 RC4
PrestaShop 1.6.1.0 RC5
PrestaShop 1.6.1.1
PrestaShop 1.6.1.1 RC1
PrestaShop 1.6.1.1 RC2
PrestaShop 1.6.1.2
PrestaShop 1.6.1.2 RC1
PrestaShop 1.6.1.2 RC2
PrestaShop 1.6.1.2 RC3
PrestaShop 1.6.1.2 RC4
PrestaShop 1.6.1.3
PrestaShop 1.6.1.3 RC1
PrestaShop 1.6.1.4
PrestaShop 1.6.1.5
PrestaShop 1.6.1.6
PrestaShop 1.6.1.7
PrestaShop 1.6.1.8
PrestaShop 1.6.1.9
PrestaShop 1.6.1.10
PrestaShop 1.6.1.11
PrestaShop 1.6.1.11 beta 1
PrestaShop 1.6.1.11-beta.1.0
PrestaShop 1.6.1.12
PrestaShop 1.6.1.13
PrestaShop 1.6.1.14
PrestaShop 1.6.1.15
PrestaShop 1.6.1.16
PrestaShop 1.6.1.17

Db::escape now handles properly backquotes

Skrevet den 28. marts 2018 af i PrestaShop

Official description: CORE : Db::escape now handle properly backquotes

This vulnerability affects the following application versions:

PrestaShop 1.6.0.1
PrestaShop 1.6.0.1 alpha 1
PrestaShop 1.6.0.2
PrestaShop 1.6.0.2 alpha 2
PrestaShop 1.6.0.3
PrestaShop 1.6.0.3 beta 1
PrestaShop 1.6.0.4
PrestaShop 1.6.0.4 RC1
PrestaShop 1.6.0.5
PrestaShop 1.6.0.6
PrestaShop 1.6.0.7
PrestaShop 1.6.0.8
PrestaShop 1.6.0.9
PrestaShop 1.6.0.10
PrestaShop 1.6.0.11
PrestaShop 1.6.0.12
PrestaShop 1.6.0.13
PrestaShop 1.6.0.14
PrestaShop 1.6.1.0 RC4

[PSCSX-9032] Secure FO from JS injection in URL

Skrevet den 28. marts 201824. maj 2026 af i PrestaShop

Official description: FO:bug#PSCSX-9032, secure token from js injection by htmlentities

This vulnerability affects the following application versions:

PrestaShop 1.6.0.3
PrestaShop 1.6.0.3 beta 1
PrestaShop 1.6.0.4
PrestaShop 1.6.0.4 RC1
PrestaShop 1.6.0.5
PrestaShop 1.6.0.6
PrestaShop 1.6.0.7
PrestaShop 1.6.0.8
PrestaShop 1.6.0.9
PrestaShop 1.6.0.11
PrestaShop 1.6.0.12
PrestaShop 1.6.0.13
PrestaShop 1.6.0.14
PrestaShop 1.6.1.0
PrestaShop 1.6.1.0 RC4
PrestaShop 1.6.1.0 RC5
PrestaShop 1.6.1.1
PrestaShop 1.6.1.1 RC1
PrestaShop 1.6.1.1 RC2
PrestaShop 1.6.1.2
PrestaShop 1.6.1.2 RC1
PrestaShop 1.6.1.2 RC2
PrestaShop 1.6.1.2 RC3
PrestaShop 1.6.1.2 RC4
PrestaShop 1.6.1.3
PrestaShop 1.6.1.3 RC1
PrestaShop 1.6.1.4
PrestaShop 1.6.1.5
PrestaShop 1.6.1.6
PrestaShop 1.6.1.7
PrestaShop 1.6.1.8
PrestaShop 1.6.1.9
PrestaShop 1.6.1.10
PrestaShop 1.6.1.11
PrestaShop 1.6.1.11 beta 1
PrestaShop 1.6.1.11-beta.1.0
PrestaShop 1.6.1.12
PrestaShop 1.6.1.13
PrestaShop 1.6.1.14
PrestaShop 1.6.1.15
PrestaShop 1.6.1.16

[7693] Force password controller to use SSL when available

Skrevet den 28. marts 2018 af i PrestaShop

Official description: #7693: Password controller must be in SSL when available

This vulnerability affects the following application versions:

PrestaShop 1.5.6.0
PrestaShop 1.5.6.1
PrestaShop 1.5.6.2
PrestaShop 1.6.0.1
PrestaShop 1.6.0.1 alpha 1
PrestaShop 1.6.0.2
PrestaShop 1.6.0.2 alpha 2
PrestaShop 1.6.0.3
PrestaShop 1.6.0.3 beta 1
PrestaShop 1.6.0.4
PrestaShop 1.6.0.4 RC1
PrestaShop 1.6.0.5
PrestaShop 1.6.0.6
PrestaShop 1.6.0.7
PrestaShop 1.6.0.8
PrestaShop 1.6.0.9
PrestaShop 1.6.0.10
PrestaShop 1.6.0.11
PrestaShop 1.6.0.12
PrestaShop 1.6.0.13
PrestaShop 1.6.0.14
PrestaShop 1.6.1.0
PrestaShop 1.6.1.0 RC4
PrestaShop 1.6.1.0 RC5
PrestaShop 1.6.1.1
PrestaShop 1.6.1.1 RC1
PrestaShop 1.6.1.1 RC2
PrestaShop 1.6.1.2
PrestaShop 1.6.1.2 RC1
PrestaShop 1.6.1.2 RC2
PrestaShop 1.6.1.2 RC3
PrestaShop 1.6.1.2 RC4
PrestaShop 1.6.1.3
PrestaShop 1.6.1.3 RC1
PrestaShop 1.6.1.4
PrestaShop 1.6.1.5
PrestaShop 1.6.1.6
PrestaShop 1.6.1.7
PrestaShop 1.6.1.8
PrestaShop 1.6.1.9
PrestaShop 1.6.1.10
PrestaShop 1.6.1.11
PrestaShop 1.6.1.11 beta 1
PrestaShop 1.6.1.11-beta.1.0
PrestaShop 1.6.1.12
PrestaShop 1.6.1.13
PrestaShop 1.6.1.14
PrestaShop 1.6.1.15
PrestaShop 1.6.1.16
PrestaShop 1.7.0.0
PrestaShop 1.7.0.0 alpha3
PrestaShop 1.7.0.0 alpha4
PrestaShop 1.7.0.0 beta1
PrestaShop 1.7.0.0 beta2
PrestaShop 1.7.0.0 beta3
PrestaShop 1.7.0.0 RC0
PrestaShop 1.7.0.0 RC1
PrestaShop 1.7.0.0 RC2
PrestaShop 1.7.0.0 RC3
PrestaShop 1.7.0.1
PrestaShop 1.7.0.2
PrestaShop 1.7.0.3
PrestaShop 1.7.0.4
PrestaShop 1.7.0.5
PrestaShop 1.7.0.6
PrestaShop 1.7.1.0
PrestaShop 1.7.1.0 beta1

[PSCSX-9132] Secure the contact_form from spammers

Skrevet den 28. marts 201824. maj 2026 af i PrestaShop

Official description: FO: bug#PSCSX-9132, I adopt the solution in this link( http://www.nfriedly.com/techblog/2009/11/how-to-build-a-spam-free-contact-forms-without-captchas/ ) to solve the problem of spamming the contact form

This vulnerability affects the following application versions: