CVE-2026-14846Incorrect neutralisation in the PrestaShop firmware
Updated under an hour ago ()
Does this affect you?
It affects PrestaShop The firmware. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In version 8.2.1 of PrestaShop, there is a vulnerability relating to the incorrect sanitisation of elements, caused by inadequate validation of the ‘Alias’ parameter in the ‘Update your address’ function. This flaw allows an attacker to inject malicious expressions that are executed when the information is exported using the ‘Get my data in CSV’ tool. Successful exploitation of this vulnerability could facilitate unauthorised access to the victim’s personal data.
- CVSS
- 4.5 MEDIUM (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:L/VI:L/VA:L/SC:L/SI:L/SA:H
- Weakness (CWE)
- CWE-1236
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- INCIBE
- NVD analysis
- Deferred
- Record last updated
- Jul 13, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
PrestaShop The firmware prestashop:the_firmware (from the name) | 8.2.1 | CNA record |
References
- https://www.incibe.es/en/incibe-cert/notices/aviso/incorrect-neutralisation-prestashop-firmware
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.