CVE-2024-21628

PrestaShop is an open-source e-commerce platform. Prior to version 8.1.3, the isCleanHtml method is not used on this this form, which makes it possible to store a cross-site scripting payload in the database. The impact is low because the HTML is not interpreted in BO, thanks to twig's escape mechanism. In FO, the cross-site scripting attack is effective, but only impacts the customer sending it, or the customer session from which it was sent. This issue affects those who have a module fetching these messages from the DB and displaying it without escaping HTML. Version 8.1.3 contains a patch for this issue.

• CWE-79

• https://github.com/PrestaShop/PrestaShop/commit/c3d78b7e49f5fe49a9d07725c3174d005deaa597Patch
• https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-vr7m-r9vm-m4wfVendor Advisory
• https://github.com/PrestaShop/PrestaShop/commit/c3d78b7e49f5fe49a9d07725c3174d005deaa597Patch
• https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-vr7m-r9vm-m4wfVendor Advisory

Published

Jan 2, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-21622Craft is a content management system. This is a potential mo…8.8
• CVE-2024-21623OTCLient is an alternative tibia client for otserv. Prior to…9.8
• CVE-2024-21624nonebot2 is a cross-platform Python asynchronous chatbot fra…6.5
• CVE-2024-21625SideQuest is a place to get virtual reality applications for…8.8
• CVE-2024-21626runc is a CLI tool for spawning and running containers on Li…8.6
• CVE-2024-21627PrestaShop is an open-source e-commerce platform. Prior to v…6.1
• CVE-2024-21629Rust EVM is an Ethereum Virtual Machine interpreter. In `rus…7.5
• CVE-2024-2163The Ninja Beaver Add-ons for Beaver Builder plugin for WordP…6.4
• CVE-2024-21630Zulip is an open-source team collaboration tool. A vulnerabi…4.3
• CVE-2024-21631Vapor is an HTTP web framework for Swift. Prior to version 4…6.5
• CVE-2024-21632omniauth-microsoft_graph provides an Omniauth strategy for t…9.8
• CVE-2024-21633Apktool is a tool for reverse engineering Android APK files.…7.8