# cve.now: Prestashop

The newest entries naming Prestashop as an affected vendor (up to 200), of 78 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-124916](https://cve.now/CVE-2026-124916.md): PrestaShop Performance Debug Configuration PHP Code Injection (CVSS 5.4)
- [CVE-2026-92810](https://cve.now/CVE-2026-92810.md): PrestaShop blockwishlist through 3.0.2 Information Disclosure (CVSS 5.3)
- [CVE-2026-92809](https://cve.now/CVE-2026-92809.md): PrestaShop psgdpr through 1.4.3 GDPR Log Forgery (CVSS 5.3)
- [CVE-2026-84186](https://cve.now/CVE-2026-84186.md): Incorrect access control in PrestaShop (CVSS 6.9)
- [CVE-2026-54159](https://cve.now/CVE-2026-54159.md): ps\_facetedsearch: PHP Object Injection in faceted search cache allows unauthenticated RCE (CVSS 10.0)
- [CVE-2026-14846](https://cve.now/CVE-2026-14846.md): Incorrect neutralisation in the PrestaShop firmware (CVSS 4.5)
- [CVE-2026-44212](https://cve.now/CVE-2026-44212.md): PrestaShop: Stored XSS executable in customer service view (CVSS 9.3)
- [CVE-2026-33674](https://cve.now/CVE-2026-33674.md): PrestaShop: Improper Use of Validation Framework (CVSS 2.0)
- [CVE-2026-33673](https://cve.now/CVE-2026-33673.md): PrestaShop has multiple stored XSS vulnerabilities via unprotected Template variables (CVSS 7.7)
- [CVE-2026-25597](https://cve.now/CVE-2026-25597.md): PrestaShop has a time based enumeration in FO login form (CVSS 5.3)
- [CVE-2025-1230](https://cve.now/CVE-2025-1230.md): Cross-Site Scripting (XSS) vulnerability in Prestashop (CVSS 4.8)
- [CVE-2025-24027](https://cve.now/CVE-2025-24027.md): ps\_contactinfo has potential XSS due to usage of the nofilter tag in template (CVSS 6.2)
- [CVE-2024-34717](https://cve.now/CVE-2024-34717.md): Anonymous PrestaShop customer can download other customers' invoices (CVSS 5.3)
- [CVE-2024-34716](https://cve.now/CVE-2024-34716.md): PrestaShop vulnerable to XSS via customer contact form in FO, through file upload (CVSS 9.7)
- [CVE-2024-26129](https://cve.now/CVE-2024-26129.md): Prestashop vulnerable to path disclosure in JavaScript variable (CVSS 5.8)
- [CVE-2024-21628](https://cve.now/CVE-2024-21628.md): XSS can be stored in DB from "add a message form" in order detail page (FO) (CVSS 5.4)
- [CVE-2024-21627](https://cve.now/CVE-2024-21627.md): Some attribute not escaped in Validate::isCleanHTML method (CVSS 8.1)
- [CVE-2023-47110](https://cve.now/CVE-2023-47110.md): Any value can be changed in the configuration table by an employee having access to block reassurance module (CVSS 9.1)
- [CVE-2023-47109](https://cve.now/CVE-2023-47109.md): PrestaShop blockreassurance BO User can remove any file from server when adding a and deleting a block (CVSS 5.5)
- [CVE-2023-43664](https://cve.now/CVE-2023-43664.md): Employee without any access rights can list all installed modules in Prestashop (CVSS 4.3)
- [CVE-2023-43663](https://cve.now/CVE-2023-43663.md): Improper Privilege Management in Prestashop (CVSS 6.3)
- [CVE-2022-45448](https://cve.now/CVE-2022-45448.md): Cross-site Scripting in M4 PDF plugin for Prestashop sites (CVSS 3.5)
- [CVE-2022-45447](https://cve.now/CVE-2022-45447.md): Path Traversal in M4 PDF plugin for Prestashop sites (CVSS 6.5)
- [CVE-2023-39530](https://cve.now/CVE-2023-39530.md): PrestaShop vulnerable to file deletion via CustomerMessage (CVSS 6.5)
- [CVE-2023-39529](https://cve.now/CVE-2023-39529.md): PrestaShop vulnerable to file deletion via attachment API (CVSS 6.7)
- [CVE-2023-39528](https://cve.now/CVE-2023-39528.md): PrestaShop vulnerable to file reading through path traversal (CVSS 6.8)
- [CVE-2023-39527](https://cve.now/CVE-2023-39527.md): PrestaShop XSS vulnerability through Validate::isCleanHTML method (CVSS 8.3)
- [CVE-2023-39526](https://cve.now/CVE-2023-39526.md): PrestaShopSQL manager vulnerability (potential RCE) (CVSS 9.1)
- [CVE-2023-39525](https://cve.now/CVE-2023-39525.md): PrestaShop vulnerable to path traversal (CVSS 6.5)
- [CVE-2023-39524](https://cve.now/CVE-2023-39524.md): PrestaShop vulnerable to boolean SQL injection in search product in BO (CVSS 6.7)
- [CVE-2023-30839](https://cve.now/CVE-2023-30839.md): PrestaShop vulnerable to SQL filter bypass leading to arbitrary write requests using "SQL Manager" (CVSS 10.0)
- [CVE-2023-30838](https://cve.now/CVE-2023-30838.md): PrestaShop vulnerable to possible XSS injection through Validate::isCleanHTML method (CVSS 8.6)
- [CVE-2023-30545](https://cve.now/CVE-2023-30545.md): PrestaShop arbitrary file read vulnerability (CVSS 7.7)
- [CVE-2023-25170](https://cve.now/CVE-2023-25170.md): PrestaShop has possible CSRF token fixation (CVSS 5.0)
- [CVE-2022-46158](https://cve.now/CVE-2022-46158.md): Potential Information exposure in the upload directory in PrestaShop (CVSS 5.3)
- [CVE-2022-35933](https://cve.now/CVE-2022-35933.md): PrestaShop module Product Comments vulnerable to cross-site scripting (XSS) (CVSS 4.3)
- [CVE-2022-31181](https://cve.now/CVE-2022-31181.md): Remote code execution in prestashop (CVSS 9.8)
- [CVE-2022-31101](https://cve.now/CVE-2022-31101.md): SQL Injection in prestashop/blockwishlist (CVSS 8.1)
- [CVE-2022-21686](https://cve.now/CVE-2022-21686.md): Server Side Twig Template Injection in PrestaShop (CVSS 9.0)
- [CVE-2021-43789](https://cve.now/CVE-2021-43789.md): Blind SQLi using Search filters in PrestaShop (CVSS 7.5)
- [CVE-2021-21418](https://cve.now/CVE-2021-21418.md): Potential XSS injection in the newsletter conditions field (CVSS 4.6)
- [CVE-2021-21398](https://cve.now/CVE-2021-21398.md): Possible XSS injection through DataColumn Grid class (CVSS 5.4)
- [CVE-2021-21308](https://cve.now/CVE-2021-21308.md): Improper session management for soft logout (CVSS 6.1)
- [CVE-2021-21302](https://cve.now/CVE-2021-21302.md): CSV Injection via csv export (CVSS 6.8)
- [CVE-2020-26248](https://cve.now/CVE-2020-26248.md): Blind SQL injection during the CommentGrade process (CVSS 6.8)
- [CVE-2020-26225](https://cve.now/CVE-2020-26225.md): Reflected XSS in PrestaShop Product Comments (CVSS 8.7)
- [CVE-2020-26224](https://cve.now/CVE-2020-26224.md): Improper Access Control in PrestaShop (CVSS 7.5)
- [CVE-2020-15162](https://cve.now/CVE-2020-15162.md): Stored XSS in PrestaShop (CVSS 5.4)
- [CVE-2020-15160](https://cve.now/CVE-2020-15160.md): Blind SQL Injection in PrestaShop (no CVSS)
- [CVE-2020-15161](https://cve.now/CVE-2020-15161.md): Potential XSS in PrestaShop (CVSS 5.4)
- [CVE-2020-15178](https://cve.now/CVE-2020-15178.md): Potential XSS in PrestaShop contactform (CVSS 8.0)
- [CVE-2020-15102](https://cve.now/CVE-2020-15102.md): Improper access control on dashboard form in PrestaShop (CVSS 6.5)
- [CVE-2020-4074](https://cve.now/CVE-2020-4074.md): Improper Authentication (CVSS 8.9)
- [CVE-2020-15082](https://cve.now/CVE-2020-15082.md): External control of configuration setting in the dashboard in PrestaShop (CVSS 7.1)
- [CVE-2020-15083](https://cve.now/CVE-2020-15083.md): Reflected XSS when uploading an image in the Product page in PrestaShop (CVSS 4.7)
- [CVE-2020-11074](https://cve.now/CVE-2020-11074.md): Stored XSS in PrestaShop (CVSS 5.4)
- [CVE-2020-15079](https://cve.now/CVE-2020-15079.md): Improper access control in PrestaShop (CVSS 6.4)
- [CVE-2020-15080](https://cve.now/CVE-2020-15080.md): Information disclosure in release archive in PrestaShop (CVSS 5.3)
- [CVE-2020-15081](https://cve.now/CVE-2020-15081.md): Information exposure in the upload directory in PrestaShop (CVSS 5.3)
- [CVE-2020-5286](https://cve.now/CVE-2020-5286.md): Reflected XSS related in import page in PrestaShop (CVSS 4.1)
- [CVE-2020-5287](https://cve.now/CVE-2020-5287.md): Improper access control on customers search in PrestaShop (CVSS 4.1)
- [CVE-2020-5288](https://cve.now/CVE-2020-5288.md): Improper access control on product attributes page in PrestaShop (CVSS 4.1)
- [CVE-2020-5293](https://cve.now/CVE-2020-5293.md): Improper access control on product page with combinations, attachments and specific prices in PrestaShop (CVSS 6.5)
- [CVE-2020-5271](https://cve.now/CVE-2020-5271.md): Reflected XSS with dashboard calendar of PrestaShop (CVSS 4.1)
- [CVE-2020-5272](https://cve.now/CVE-2020-5272.md): Reflected XSS on Search page of PrestaShop (CVSS 4.1)
- [CVE-2020-5276](https://cve.now/CVE-2020-5276.md): Reflected XSS on AdminCarts page of PrestaShop (CVSS 4.1)
- [CVE-2020-5278](https://cve.now/CVE-2020-5278.md): Reflected XSS on Exception page of PrestaShop (CVSS 4.1)
- [CVE-2020-5279](https://cve.now/CVE-2020-5279.md): Improper Access Control for certain legacy controller in PrestaShop (CVSS 4.1)
- [CVE-2020-5285](https://cve.now/CVE-2020-5285.md): Reflected XSS with back parameter in PrestaShop (CVSS 4.1)
- [CVE-2020-5269](https://cve.now/CVE-2020-5269.md): Reflected XSS on AdminFeatures page of PrestaShop (CVSS 4.1)
- [CVE-2020-5270](https://cve.now/CVE-2020-5270.md): Open redirection when using back parameter of PrestaShop (CVSS 4.1)
- [CVE-2020-5264](https://cve.now/CVE-2020-5264.md): Reflected XSS in security compromised page of PrestaShop (CVSS 4.4)
- [CVE-2020-5265](https://cve.now/CVE-2020-5265.md): Reflected XSS on AdminAttributesGroups page of PrestaShop (CVSS 4.4)
- [CVE-2020-5266](https://cve.now/CVE-2020-5266.md): Stored XSS on back office edit page (CVSS 4.4)
- [CVE-2020-5273](https://cve.now/CVE-2020-5273.md): Stored XSS with custom URLs in PrestaShop module ps\_linklist (CVSS 4.1)
- [CVE-2020-5294](https://cve.now/CVE-2020-5294.md): Reflected XSS with social networks fields (CVSS 4.1)
- [CVE-2020-5277](https://cve.now/CVE-2020-5277.md): Reflected XSS with url\_name parameter of PrestaShop module ps\_facetedsearch (CVSS 4.1)
- [CVE-2020-5250](https://cve.now/CVE-2020-5250.md): Possible information disclosure in PrestaShop (CVSS 7.6)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/prestashop
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.