CVE-2020-15161

medium

Description

In PrestaShop from version 1.6.0.4 and before version 1.7.6.8 an attacker is able to inject javascript while using the contact form. The problem is fixed in 1.7.6.8

References

Advisories

https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-5cp2-r794-w37w

https://github.com/PrestaShop/PrestaShop/releases/tag/1.7.6.8

https://github.com/PrestaShop/PrestaShop/commit/562a231fec18a928e4a601860416fe11af274672

Details

Source: Mitre, NVD

Published: 2020-09-24

Updated: 2026-06-17

Risk Information

CVSS v2

Base Score: 4.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

Severity: Medium

CVSS v3

Base Score: 6.1

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N