CVE-2020-15162

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

In PrestaShop from version 1.5.0.0 and before version 1.7.6.8, users are allowed to send compromised files. These attachments allowed people to input malicious JavaScript which triggered an XSS payload. The problem is fixed in version 1.7.6.8.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Sep 24, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-151638.2Python TUF (The Update Framework) reference implementation before version 0.12 it will incorrectly trust a previously downloaded root metada CVE-2020-1516410.0in Scratch Login (MediaWiki extension) before version 1.1, any account can be logged into by using the same username with leading, trailing,CVE-2020-151659.1Version 1.1.6-free of Chameleon Mini Live Debugger on Google Play Store may have had it's sources or permissions tampered by a malicious act CVE-2020-151667.5In ZeroMQ before version 4.3.3, there is a denial-of-service vulnerability. Users with TCP transport public endpoints, even with CURVE/ZAP e CVE-2020-151678.6In Miller (command line utility) using the configuration file support introduced in version 5.9.0, it is possible for an attacker to cause M CVE-2020-151685.3node-fetch before versions 2.6.1 and 3.0.0-beta.9 did not honor the size option after following a redirect, which means that when a content CVE-2020-151696.1In Action View before versions 5.2.4.4 and 6.0.3.3 there is a potential Cross-Site Scripting (XSS) vulnerability in Action View's translatio CVE-2020-15177.8An elevation of privilege vulnerability exists when the Windows File Server Resource Management Service improperly handles memory. To exploi CVE-2020-151707.0apollo-adminservice before version 1.7.1 does not implement access controls. If users expose apollo-adminservice to internet(which is not re CVE-2020-151716.6In XWiki before versions 11.10.5 or 12.2.1, any user with SCRIPT right (EDIT right before XWiki 7.4) can gain access to the application serv CVE-2020-151728.8The Act module for Red Discord Bot before commit 6b9f3b86 is vulnerable to Remote Code Execution. With this exploit, Discord users can use s CVE-2020-151739.8In ACCEL-PPP (an implementation of PPTP/PPPoE/L2TP/SSTP), there is a buffer overflow when receiving an l2tp control packet ith an AVP which