Vulnerabilidades em PrestaShop

74 resultados
Análise Vexday

Com 69 CVEs catalogadas, o PrestaShop apresenta taxa de exploração ativa abaixo da média geral do catálogo CISA KEV, sem registros confirmados de exploração em curso — o que não elimina o risco, dado que 6 vulnerabilidades possuem PoC pública e o maior EPSS observado chega a 0,5617, valor consideravelmente elevado. Esse escore máximo pertence à CVE-2024-34716, que deve receber atenção prioritária por combinar alta probabilidade de exploração com disponibilidade de prova de conceito. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), padrão que tende a ser subestimado operacionalmente, mas que em plataformas de e-commerce pode viabilizar roubo de sessão e comprometimento de dados de clientes. Das 7 CVEs críticas catalogadas, a presença de PoCs públicas em parte delas sugere que equipes responsáveis por instâncias PrestaShop devem priorizar a aplicação de patches e o monitoramento ativo de exploração.

CVE-2024-34716CRITICALPrestaShop vulnerable to XSS via customer contact form in FO, through file uploadEPSS 56.2%CVE-2022-31101HIGHSQL Injection in prestashop/blockwishlistEPSS 22.7%CVE-2020-26248MEDIUMBlind SQL injection during the CommentGrade processEPSS 12.4%CVE-2020-15160—Blind SQL Injection in PrestaShopEPSS 10.8%CVE-2022-31181CRITICALRemote code execution in prestashopEPSS 6.5%CVE-2021-43789HIGHBlind SQLi using Search filters in PrestaShopEPSS 4.6%CVE-2022-21686CRITICALServer Side Twig Template Injection in PrestaShopEPSS 1.8%CVE-2020-4074HIGHImproper AuthenticationEPSS 1.8%CVE-2020-26224HIGHImproper Access Control in PrestaShopEPSS 1.7%CVE-2023-30839CRITICALPrestaShop vulnerable to SQL filter bypass leading to arbitrary write requests using "SQL Manager"EPSS 1.7%CVE-2020-15081MEDIUMInformation exposure in the upload directory in PrestaShopEPSS 1.6%CVE-2021-21302MEDIUMCSV Injection via csv exportEPSS 1.4%CVE-2023-39526CRITICALPrestaShopSQL manager vulnerability (potential RCE)EPSS 1.3%CVE-2020-15178HIGHPotential XSS in PrestaShop contactformEPSS 1.2%CVE-2020-15082HIGHExternal control of configuration setting in the dashboard in PrestaShopEPSS 1.2%CVE-2021-21308MEDIUMImproper session management for soft logoutEPSS 1.0%CVE-2023-30838HIGHPrestaShop vulnerable to possible XSS injection through Validate::isCleanHTML methodEPSS 1.0%CVE-2020-15080MEDIUMInformation disclosure in release archive in PrestaShopEPSS 0.9%CVE-2020-15161MEDIUMPotential XSS in PrestaShopEPSS 0.9%CVE-2020-26225HIGHReflected XSS in PrestaShop Product CommentsEPSS 0.9%