CVE-2020-26224

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

In PrestaShop before version 1.7.6.9 an attacker is able to list all the orders placed on the website without being logged by abusing the function that allows a shopping cart to be recreated from an order already placed. The problem is fixed in 1.7.6.9.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
PrestaShop	PrestaShop	>= 1.4.10.0 < 1.7.6.9

References

https://github.com/PrestaShop/PrestaShop/commit/709d9afab7bdba1de5d7225a40e4f28c35975909Exploit, Third Party Advisory
https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-frf2-c9q3-qg9mThird Party Advisory
https://github.com/PrestaShop/PrestaShop/commit/709d9afab7bdba1de5d7225a40e4f28c35975909Exploit, Third Party Advisory
https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-frf2-c9q3-qg9mThird Party Advisory

Timeline

Published: Nov 16, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-262256.1In PrestaShop Product Comments before version 4.2.0, an attacker could inject malicious web code into the users' web browsers by creating a CVE-2020-262268.1In the npm package semantic-release before version 17.2.3, secrets that would normally be masked by `semantic-release` can be accidentally d CVE-2020-262276.1TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 9.5.23 and 10.4.10 the system extension Fluid (typ CVE-2020-262287.5TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 9.5.23 and 10.4.10 user session identifiers were s CVE-2020-262293.7TYPO3 is an open source PHP based web content management system. In TYPO3 from version 10.4.0, and before version 10.4.10, RSS widgets are s CVE-2020-26236.0Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metrics Framework). Supported version CVE-2020-262305.3Radar COVID is the official COVID-19 exposure notification app for Spain. In affected versions of Radar COVID, identification and de-anonymi CVE-2020-262316.7October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. A bypass of CVE-2020-15247 (fixed in 1.0.469 an CVE-2020-262325.4Jupyter Server before version 1.0.6 has an Open redirect vulnerability. A maliciously crafted link to a jupyter server could redirect the br CVE-2020-262337.3Git Credential Manager Core (GCM Core) is a secure Git credential helper built on .NET Core that runs on Windows and macOS. In Git Credentia CVE-2020-262344.8Opencast before versions 8.9 and 7.9 disables HTTPS hostname verification of its HTTP client used for a large portion of Opencast's HTTP req CVE-2020-262355.3In Rust time crate from version 0.2.7 and before version 0.2.23, unix-like operating systems may segfault due to dereferencing a dangling po