Executive brief
PrestaShop XSS can be stored in DB from "add a message form" in order detail page (FO)
Affected products
- Packagist prestashop/prestashop
Junglewise Threat Intelligence
CVE-2024-21628: PrestaShop XSS can be stored in DB from "add a message form" in order detail page (FO)
CVE-2024-21628 · Severity: low · CVSS 3.1 · Published 2024-01-03
Technologies: prestashop/prestashop (Packagist). Vendors: Packagist.
Related threats
- Presta Shop vulnerable to email enumeration
- Anonymous PrestaShop customer can download other customers' invoices
- PrestaShop cross-site scripting via customer contact form in FO, through file upload
- Path disclosure in JavaScript variable
- PrestaShop allows users to uninstall modules from backoffice, even with low rights