Vulnerabilidades de Prestashop
CVEs publicadas que afetam produtos de Prestashop: 7 registro(s), com severidade, exploração e correções.
CVE-2026-44212
Crítica · 9.3
CWE-79 14/05/2026
PrestaShop: XSS armazenado na visualização de Atendimento ao Cliente do back-office
PrestaShop é uma aplicação web de e-commerce de código aberto. Antes das versões 8.2.6 e 9.1.1, há uma vulnerabilidade de Cross-Site Scripting (XSS) armazenado na visualização de Atendimento ao Cliente do back-office do PrestaShop. Um atacante não autenticado pode enviar o formulário público Fale Conosco com um endereço de e-mail malicioso. A carga maliciosa é armazenada no banco de dados e executada quando um funcionário do back-office abre a conversa do cliente afetada, possibilitando sequestro de sessão e tomada completa do back-office. Esta vulnerabilidade está corrigida nas versões 8.2.6 e 9.1.1.
CVE-2026-33674
Média · 5.3
CWE-1173 26/03/2026
PrestaShop: Improper Use of Validation Framework
PrestaShop is an open source e-commerce web application. Versions prior to 8.2.5 and 9.1.0 improperly use the validation framework. Versions 8.2.5 and 9.1.0 contain a fix. No known workarounds are available.
CVE-2026-33673
Média · 5.4
CWE-79 26/03/2026
PrestaShop has multiple stored XSS vulnerabilities via unprotected Template variables
PrestaShop is an open source e-commerce web application. Versions prior to 8.2.5 and 9.1.0 are vulnerable to stored Cross-Site Scripting (stored XSS) vulnerabilities in the BO. An attacker who can inject data into the database, via limited back-office access or a previously existing vulnerability, can exploit unprotected variables in back-office templates. Versions 8.2.5 and 9.1.0 contain a fix. No known workarounds are available.
CVE-2026-25597
Média · 5.3
CWE-208 06/02/2026
PrestaShop has a time based enumeration in FO login form
PrestaShop is an open source e-commerce web application. Prior to 8.2.4 and 9.0.3, there is a time-based user enumeration vulnerability in the user authentication functionality of PrestaShop. This vulnerability allows an attacker to determine whether a customer account exists in the system by measuring response times. This vulnerability is fixed in 8.2.4 and 9.0.3.
CVE-2025-61924
Baixa · 3.8
CWE-184 16/10/2025
PrestaShop Checkout Target PayPal merchant account hijacking from backoffice
PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal. In versions prior to 4.4.1 and 5.0.5, the Target PayPal merchant account hijacking from backoffice due to wrong usage of the PHP array_search(). The vulnerability is fixed in versions 4.4.1 and 5.0.5. No known workarounds exist.
CVE-2025-61923
Média · 4.1
CWE-22 16/10/2025
PrestaShop Checkout Backoffice directory traversal allows arbitrary file disclosure
PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal. In versions prior to 4.4.1 and 5.0.5, the backoffice is missing validation on input resulting in a directory traversal and arbitrary file disclosure. The vulnerability is fixed in versions 4.4.1 and 5.0.5. No known workarounds exist.
CVE-2025-61922
Crítica · 9.1
CWE-287 16/10/2025
PrestaShop Checkout allows customer account takeover via email
PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal. Starting in version 1.3.0 and prior to versions 4.4.1 and 5.0.5, missing validation on the Express Checkout feature allows silent login, enabling account takeover via email. The vulnerability is fixed in versions 4.4.1 and 5.0.5. No known workarounds exist.