CVE-2026-14846
MEDIUM
MEDIUM
Priority: 0.02
BB Relevance:
44/100
Published: 2026-07-13
Modified: 2026-10-24
First seen: 2026-10-29
Status: active
Attack Surface
Network
Low Complexity
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
High
UI:
Active
S:
X
AT:
Present
VC:
Low
VI:
Low
VA:
Low
Description
In version 8.2.1 of PrestaShop, there is a vulnerability relating to the incorrect sanitisation of elements, caused by inadequate validation of the ‘Alias’ parameter in the ‘Update your address’ function. This flaw allows an attacker to inject malicious expressions that are executed when the information is exported using the ‘Get my data in CSV’ tool. Successful exploitation of this vulnerability could facilitate unauthorised access to the victim’s personal data.