PrestaShop vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2024-41651 An issue in Prestashop v.8.1.7 and before allows a remote attacker to execute arbitrary code via the module upgrade functionality.High 8.1 · Aug 12, 2024
• CVE-2024-34992 SQL Injection vulnerability in the module "Help Desk - Customer Support Management System" (helpdesk) up to version 2.4.0 from FME Modules for PrestaShop allowsHigh 8.8 · Jun 24, 2024
• CVE-2024-34988 SQL injection vulnerability in the module "Complete for Create a Quote in Frontend + Backend Pro" (askforaquotemodul) <= 1.0.51 from Buy Addons for PrestaShop aCritical 9.8 · Jun 24, 2024
• CVE-2023-50029 PHP Injection vulnerability in the module "M4 PDF Extensions" (m4pdf) up to version 3.3.2 from PrestaAddons for PrestaShop allows attackers to run arbitrary codCritical 10 · Jun 24, 2024
• CVE-2024-34991 In the module "Axepta" (axepta) before 1.3.4 from Quadra Informatique for PrestaShop, a guest can download partial credit card information (expiry date) / postaHigh 7.5 · Jun 24, 2024
• CVE-2024-34989 In the module RSI PDF/HTML catalog evolution (prestapdf) <= 7.0.0 from RSI for PrestaShop, a guest can perform SQL injection via `PrestaPDFProductListModuleFronCritical 9.8 · Jun 21, 2024
• CVE-2024-36679 In the module "Module Live Chat Pro (All in One Messaging)" (livechatpro) <=8.4.0, a guest can perform PHP Code injection.Critical 10 · Jun 19, 2024
• CVE-2024-36677 In the module "Login as customer PRO" (loginascustomerpro) <1.2.7 from Weblir for PrestaShop, a guest can access direct link to connect to each customer accountHigh 7.5 · Jun 19, 2024
• CVE-2024-34994 In the module "Channable" (channable) up to version 3.2.1 from Channable for PrestaShop, a guest can perform SQL injection via `ChannableFeedModuleFrontControllCritical 9.8 · Jun 19, 2024
• CVE-2024-34990 In the module "Help Desk - Customer Support Management System" (helpdesk) up to version 2.4.0 from FME Modules for PrestaShop, a customer can upload .php files.Critical 10 · Jun 19, 2024
• CVE-2024-34716 PrestaShop is an open source e-commerce web application.Critical 9.6 · May 14, 2024
• CVE-2024-33274 Directory Traversal vulnerability in FME Modules customfields v.2.2.7 and before allows a remote attacker to obtain sensitive information via the Custom CheckouHigh 7.5 · Apr 30, 2024
• CVE-2024-33270 An issue in FME Modules fileuploads v.2.0.3 and before and fixed in v2.0.4 allows a remote attacker to obtain sensitive information via the uploadfiles.php compHigh 7.5 · Apr 30, 2024
• CVE-2024-33276 SQL Injection vulnerability in FME Modules preorderandnotication v.3.1.0 and before allows a remote attacker to run arbitrary SQL commands via the PreorderModelCritical 9.8 · Apr 29, 2024
• CVE-2024-33271 An issue in FME Modules eventsmanager before 4.4.0 allows an attacker to obtain sensitive information from the ps_customer component.High 7.5 · Apr 29, 2024
• CVE-2024-28393 SQL injection vulnerability in scalapay v.1.2.41 and before allows a remote attacker to escalate privileges via the ScalapayReturnModuleFrontController::postProCritical 9.8 · Mar 25, 2024
• CVE-2024-28392 SQL injection vulnerability in pscartabandonmentpro v.2.0.11 and before allows a remote attacker to escalate privileges via the pscartabandonmentproFrontCAPUnsuCritical 9.8 · Mar 20, 2024
• CVE-2024-25845 In the module "CD Custom Fields 4 Orders" (cdcustomfields4orders) <= 1.0.0 from Cleanpresta.com for PrestaShop, a guest can perform SQL injection in affected veCritical 9.8 · Mar 7, 2024
• CVE-2024-21627 PrestaShop is an open-source e-commerce platform.High 8.1 · Jan 2, 2024
• CVE-2023-47308 In the module "Newsletter Popup PRO with Voucher/Coupon code" (newsletterpop) before version 2.6.1 from Active Design for PrestaShop, a guest can perform SQL inCritical 9.8 · Nov 14, 2023
• CVE-2023-47110 blockreassurance adds an information block aimed at offering helpful information to reassure customers that their store is trustworthy.Critical 9.1 · Nov 9, 2023
• CVE-2023-39527 PrestaShop is an open source e-commerce web application.High 8.3 · Aug 7, 2023
• CVE-2023-39526 PrestaShop is an open source e-commerce web application.Critical 9.1 · Aug 7, 2023
• CVE-2023-30153 An SQL injection vulnerability in the Payplug (payplug) module for PrestaShop, in versions 3.6.0, 3.6.1, 3.6.2, 3.6.3, 3.7.0 and 3.7.1, allows remote attackers Critical 9.8 · Jul 18, 2023
• CVE-2023-30192 Prestashop possearchproducts 1.7 is vulnerable to SQL Injection via PosSearch::find().Critical 9.8 · May 11, 2023