CVEs (93)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
In PrestaShop before version 1.7.6.5, there is a reflected XSS while running the security compromised page. It allows anyone to execute arbitrary action. The problem is patched in the 1.7.6.5. |
In PrestaShop before version 1.7.6.4, when a customer edits their address, they can freely change the id_address in the form, and thus steal someone else's address. It is the same with CustomerForm, you are able to chang...Show more |
PrestaShop 1.5.5 vulnerable to privilege escalation via a Salesman account via upload module |
PrestaShop before 1.4.11 allows logout CSRF. |
PrestaShop before 1.4.11 allows Logistician, translators and other low level profiles/accounts to inject a persistent XSS vector on TinyMCE. |
Cross-site scripting (XSS) vulnerability in PrestaShop before 1.4.9 allows remote attackers to inject arbitrary web script or HTML via the index of the product[] parameter to ajax.php. |
PrestaShop 1.5.5 allows remote authenticated attackers to execute arbitrary code by uploading a crafted profile and then accessing it in the module/ directory. |
In PrestaShop 1.7.6.2, XSS can occur during addition or removal of a QuickAccess link. This is related to AdminQuickAccessesController.php, themes/default/template/header.tpl, and themes/new-theme/js/header.js. |
2Adobe Prestashop2Prestashop Stock Api IntegrationJun 17, 2026 Dec 5, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 reset/modules/advanced_form_maker_edit/multiupload/upload.php in the RESET.PRO Adobe Stock API integration 4.8 for PrestaShop allows remote attackers to execute arbitrary code by uploading a .php file. |
2Adobe Prestashop2Prestashop Stock Api IntegrationJun 17, 2026 Dec 5, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 reset/modules/fotoliaFoto/multi_upload.php in the RESET.PRO Adobe Stock API Integration for PrestaShop 1.6 and 1.7 allows remote attackers to execute arbitrary code by uploading a .php file. |
In PrestaShop before 1.7.6.0 RC2, the id_address_delivery and id_address_invoice parameters are affected by an Insecure Direct Object Reference vulnerability due to a guessable value sent to the web application during ch...Show more |
2Drupal Prestashop2Drupal PrestashopJun 17, 2026 May 24, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 In PrestaShop 1.7.5.2, the shop_country parameter in the install/index.php installation script/component is affected by Reflected XSS. Exploitation by a malicious actor requires the user to follow the initial stages of t...Show more |
In the orders section of PrestaShop before 1.7.2.5, an attack is possible after gaining access to a target store with a user role with the rights of at least a Salesman or higher privileges. The attacker can then inject...Show more |
2Mypresta Prestashop2Customer Files Upload PrestashopNov 21, 2024 Nov 19, 2018 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 modules/orderfiles/ajax/upload.php in the Customer Files Upload addon 2018-08-01 for PrestaShop (1.5 through 1.7) allows remote attackers to execute arbitrary code by uploading a php file via modules/orderfiles/upload.ph...Show more |
PrestaShop 1.6.x before 1.6.1.23 and 1.7.x before 1.7.4.4 allows remote attackers to execute arbitrary code via a file upload. |
PrestaShop 1.6.x before 1.6.1.23 and 1.7.x before 1.7.4.4 allows remote attackers to delete an image directory. |
PrestaShop 1.6.x before 1.6.1.23 and 1.7.x before 1.7.4.4 on Windows allows remote attackers to write to arbitrary image files. |
PrestaShop before 1.6.1.20 and 1.7.x before 1.7.3.4 mishandles cookie encryption in Cookie.php, Rinjdael.php, and Blowfish.php. |
2Prestashop Responsive Mega Menu Pro Project2Prestashop Responsive Mega Menu ProJun 17, 2026 May 10, 2018 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 modules/bamegamenu/ajax_phpcode.php in the Responsive Mega Menu (Horizontal+Vertical+Dropdown) Pro module 1.0.32 for PrestaShop 1.5.5.0 through 1.7.2.5 allows remote attackers to execute a SQL Injection through function...Show more |
2Prestashop Responsive Mega Menu Pro Project2Prestashop Responsive Mega Menu ProJun 17, 2026 Mar 28, 2018 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 modules/bamegamenu/ajax_phpcode.php in the Responsive Mega Menu (Horizontal+Vertical+Dropdown) Pro module 1.0.32 for PrestaShop 1.5.5.0 through 1.7.2.5 allows remote attackers to execute arbitrary PHP code via the code p...Show more |