CVE Tools
Track your stack

Prestashop/prestashop

28 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Prestashop/prestashop, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Prestashop/prestashop CVEs per month

Nov 2024 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Prestashop/prestashop CVEs per month
MonthCVEs
2024-110
2024-120
2025-010
2025-020
2025-030
2025-040
2025-050
2025-060
2025-070
2025-080
2025-091
2025-100
2025-110
2025-120
2026-010
2026-021
2026-030
2026-040
2026-050
2026-060
2026-070
2026-080
2026-090
2026-100

Severity

How the 28 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical518%
  • High621%
  • Medium1657%
  • Low14%

Latest CVEs

The 15 most recently published vulnerabilities affecting Prestashop/prestashop.

  1. CVE-2026-25597PrestaShop has a time based enumeration in FO login form5.3
  2. CVE-2025-51586An issue was discoverd in file controllers/admin/AdminLoginController.php in PrestaShop before 8.2.1 allowing attackers to gain sensitive information via the reset password feature.3.7
  3. CVE-2024-34717Anonymous PrestaShop customer can download other customers' invoices5.3
  4. CVE-2024-34716PrestaShop vulnerable to XSS via customer contact form in FO, through file upload9.6
  5. CVE-2024-26129Prestashop vulnerable to path disclosure in JavaScript variable5.8
  6. CVE-2024-21628XSS can be stored in DB from "add a message form" in order detail page (FO)5.4
  7. CVE-2024-21627Some attribute not escaped in Validate::isCleanHTML method8.1
  8. CVE-2023-43664Employee without any access rights can list all installed modules in Prestashop4.3
  9. CVE-2023-43663Improper Privilege Management in Prestashop6.3
  10. CVE-2023-39530PrestaShop vulnerable to file deletion via CustomerMessage6.5
  11. CVE-2023-39529PrestaShop vulnerable to file deletion via attachment API6.7
  12. CVE-2023-39528PrestaShop vulnerable to file reading through path traversal6.8
  13. CVE-2023-39527PrestaShop XSS vulnerability through Validate::isCleanHTML method8.3
  14. CVE-2023-39526PrestaShopSQL manager vulnerability (potential RCE)9.1
  15. CVE-2023-39525PrestaShop vulnerable to path traversal6.5

Product grouping is registry-driven, with AI assist and human review. How it works