ESLog inGet started free
High 8.8 CVSS 3.1 blockwishlist Published on 2022-06-27

SQL Injection

CVECVE-2022-31101 GHSAGHSA-2jx3-5j9v-prpp
View at the source View JSON Last modified at the source: 2026-06-17

Description

SQL Injection

Impact

An authenticated customer can perform SQL injection

Patches

Issue is fixed in 2.1.1

Original text by NVD (NIST), public domain.

CVSS metrics 3.1

Source: security-advisories@github.com · secondary
High 8.8
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vectorNetwork
ComplexityLow
Privileges requiredLow
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityNone

References

Found a vulnerability?

Write to the PrestaShop core security team:

security-core@prestashop.com

Related advisories

Same module: blockwishlist
All blockwishlist advisories (2)
IDAdvisoryComponentSeverityAffected versionsPublishedFix
CVE-2026-92810 PrestaShop blockwishlist through 3.0.2 fails to validate wishlist ownership in the getUrlByIdWishListAction method,… blockwishlist Medium 5.3 ≤ 3.0.2 2026-09-16 No

Do you use the blockwishlist module?

PrestaShield checks it from the outside, without FTP access, and alerts you of every new advisory that affects you.
Check if my shop is affected