CVE-2020-15160

CRITICAL 9.8CVE-2020-15160 · Published 24/09/2020 · updated 17/06/2026

In short

CVE-2020-15160 is a CRITICAL (CVSS 9.8) vulnerability affecting prestashop (prestashop).
Chance of exploitation in the next 30 days (EPSS): 10.8%, higher than 95.8% of all vulnerabilities.
Fix: update to 1.7.6.8 or later.

Package	Affected versions	Patched versions
prestashop prestashop	`≥ 1.7.5.0, < 1.7.6.8`	`1.7.6.8`

Description

PrestaShop from version 1.7.5.0 and before version 1.7.6.8 is vulnerable to a blind SQL Injection attack in the Catalog Product edition page with location parameter. The problem is fixed in 1.7.6.8

References

packetstormsecurity.com/files/162140/PrestaShop-1.7.6.7-SQL-Injection.html · Third Party Advisory
PrestaShop/PrestaShop commit 3fa0dfa · Patch
PrestaShop/PrestaShop release 1.7.6.8 · Third Party Advisory
PrestaShop/PrestaShop security advisory · Third Party Advisory

More vulnerabilities in prestashop

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

prestashop

≥ 1.7.5.0, < 1.7.6.8

1.7.6.8

More vulnerabilities in prestashop

See all →