UpHeron
All vulnerabilities

Servers and applications

CVE-2024-34716

XSS via customer contact form in FO, through file upload

Severity
Medium 6.1
Published
14 May 2024
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
8.1.6
Also known as
GHSA-45vm-3j38-7p78
Sources
NVD, Project advisories (GitHub)

Description

PrestaShop is an open source e-commerce web application. A cross-site scripting (XSS) vulnerability that only affects PrestaShops with customer-thread feature flag enabled is present starting from PrestaShop 8.1.0 and prior to PrestaShop 8.1.6. When the customer thread feature flag is enabled through the front-office contact form, a hacker can upload a malicious file containing an XSS that will…

Affected software

SoftwareAffected versions
PrestaShopServers and applications · cpe:a:prestashop:prestashop
  • From 8.1.0 before 8.1.6
PrestaShopServers and applications · github:prestashop/prestashop
  • From 8.1.0 before 8.1.6

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-34716
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-34716
  • GitHub Advisory Database https://github.com/advisories/GHSA-45vm-3j38-7p78
  • github.com https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-45vm-3j38-7p78