ESLog inGet started free
Medium 5.9 CVSS 3.1 soflexibilite Published on 2024-02-27

In the module "So Flexibilite" (soflexibilite) from Common-Services for PrestaShop < 4.1.26, a guest (authenticated customer) can perform Cross Site Scripting…

CVECVE-2024-25841 GHSANo GHSA advisory
View at the source View JSON Last modified at the source: 2026-06-17

Description

In the module "So Flexibilite" (soflexibilite) from Common-Services for PrestaShop < 4.1.26, a guest (authenticated customer) can perform Cross Site Scripting (XSS) injection.

Original text by NVD (NIST), public domain.

CVSS metrics 3.1

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · secondary
Medium 5.9
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack vectorLocal
ComplexityLow
Privileges requiredNone
User interactionNone
ScopeUnchanged
ConfidentialityLow
IntegrityLow
AvailabilityLow

References

Found a vulnerability?

Write to the PrestaShop core security team:

security-core@prestashop.com

Related advisories

Same module: soflexibilite
All soflexibilite advisories (2)
IDAdvisoryComponentSeverityAffected versionsPublishedFix
CVE-2024-25844 An issue was discovered in Common-Services "So Flexibilite" (soflexibilite) module for PrestaShop before version… soflexibilite High 7.5 < 4.1.14 2024-03-03 No

Do you use the soflexibilite module?

PrestaShield checks it from the outside, without FTP access, and alerts you of every new advisory that affects you.
Check if my shop is affected