Critical
CVE-2026-54159
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 50
Reset filters
Critical
CVE-2026-44212
PrestaShop has a stored XSS executable in customer service view
Low
ghsa-mqq7-wxx5-mp8h
ps_checkout allows unauthorized method invocation through unvalidated parameter
High
CVE-2026-33673
PrestaShop has multiple stored XSS vulnerabilities via unprotected Template variables
Low
CVE-2026-33674
PrestaShop: Improper Use of Validation Framework
Medium
CVE-2026-25597
PrestaShop affected by time based enumeration in FO login form
Low
CVE-2025-61924
PrestaShop Checkout Target PayPal merchant account hijacking from backoffice
Medium
CVE-2025-61923
PrestaShop Checkout Backoffice directory traversal allows arbitrary file disclosure
Critical
CVE-2025-61922
Customer account takeover via email in PrestaShop Checkout module for PrestaShop
Medium
CVE-2025-51586
Presta Shop vulnerable to email enumeration
Low
CVE-2025-24027
ps_contactinfo has potential XSS due to usage of the nofilter tag in template
Medium
CVE-2024-34717
Anonymous PrestaShop customer can download other customers' invoices
Critical
CVE-2024-34716
PrestaShop cross-site scripting via customer contact form in FO, through file upload
Medium
CVE-2024-26129
Path disclosure in JavaScript variable
Medium
CVE-2024-21628
PrestaShop XSS can be stored in DB from "add a message form" in order detail page (FO)
High
CVE-2024-21627
PrestaShop some attribute not escaped in Validate::isCleanHTML method
Medium
CVE-2023-47110
Any value can be changed in the configuration table by an employee having access to block reassurance module
Medium
CVE-2023-47109
PrestaShop blockreassurance BO User can remove any file from server when adding a and deleting a block
Medium
CVE-2023-43663
PrestaShop allows users to uninstall modules from backoffice, even with low rights
Medium
CVE-2023-43664
PrestaShop allows employee without any access rights to list all installed modules
Medium
CVE-2023-39530
PrestaShop file deletion via CustomerMessage
Medium
CVE-2023-39529
PrestaShop file deletion via attachment API
High
CVE-2023-39527
Possible XSS injection through Validate::isCleanHTML method
Medium
CVE-2023-39526
SQL manager vulnerability (potential RCE)
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.