PrestaShop allows users to uninstall modules from backoffice, even with low rights

CVE-2023-43663

Affected version: <8.1.2

Reported by:
GitHub

PrestaShop allows employee without any access rights to list all installed modules

CVE-2023-43664

Affected version: <8.1.2

Reported by:
GitHub

PrestaShop file deletion via CustomerMessage

CVE-2023-39530

Affected version: <=8.1.0

Reported by:
GitHub

PrestaShop file deletion via attachment API

CVE-2023-39529

Affected version: <=8.1.0

Reported by:
GitHub

PrestaShop file access through path traversal

CVE-2023-39528

Affected version: <=8.1.0

Reported by:
GitHub

PrestaShop XSS injection through Validate::isCleanHTML method

CVE-2023-39527

Affected version: <1.7.8.10|>=8.0.0,<8.0.5|=8.1.0

Reported by:
GitHub

PrestaShop SQL manager vulnerability

CVE-2023-39526

Affected version: <1.7.8.10|>=8.0.0,<8.0.5|=8.1.0

Reported by:
GitHub

PrestaShop path traversal

CVE-2023-39525

Affected version: <=8.1.0

Reported by:
GitHub

PrestaShop boolean SQL injection

CVE-2023-39524

Affected version: <=8.1.0

Reported by:
GitHub

Arbitrary file read via SQL injection

CVE-2023-30545

Affected version: <1.7.8.9|>=8.0.0,<8.0.4

Reported by:
GitHub

Possible XSS injection through Validate::isCleanHTML method

CVE-2023-30838

Affected version: <1.7.8.9|>=8.0.0,<8.0.4

Reported by:
GitHub

SQL filter bypass leading to arbitrary write requests using "SQL Manager"

CVE-2023-30839

Affected version: <1.7.8.9|>=8.0.0,<8.0.4

Reported by:
GitHub

Possible CSRF token fixation

CVE-2023-25170

Affected version: <8.0.1

Reported by:
GitHub

PrestaShop has potential Information exposure in the upload directory

CVE-2022-46158

Affected version: <1.7.8.8

Reported by:
GitHub

PrestaShop eval injection possible if shop vulnerable to SQL injection

CVE-2022-31181

Affected version: >=1.6.0.10,<1.7.8.7

Reported by:
GitHub

Server Side Twig Template Injection

CVE-2022-21686

Affected version: >=1.7.0.0,<=1.7.8.2

Reported by:
GitHub