CVE-2021-21398

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

PrestaShop is a fully scalable open source e-commerce solution. In PrestaShop before version 1.7.7.3, an attacker can inject HTML when the Grid Column Type DataColumn is badly used. The problem is fixed in 1.7.7.3

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
PrestaShop	PrestaShop	>= 1.7.7.0, < 1.7.7.3

References

https://github.com/PrestaShop/PrestaShop/commit/aaaba8177f3b3c510461b5e3249e30e60f900205Patch, Third Party Advisory
https://github.com/PrestaShop/PrestaShop/releases/tag/1.7.7.3Third Party Advisory
https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-fhhq-4x46-qx77Third Party Advisory
https://github.com/PrestaShop/PrestaShop/commit/aaaba8177f3b3c510461b5e3249e30e60f900205Patch, Third Party Advisory
https://github.com/PrestaShop/PrestaShop/releases/tag/1.7.7.3Third Party Advisory
https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-fhhq-4x46-qx77Third Party Advisory

Timeline

Published: Mar 30, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-213997.5Ampache is a web based audio/video streaming application and file manager. Versions prior to 4.4.1 allow unauthenticated access to Ampache u CVE-2021-21406.1Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (com CVE-2021-214006.5wire-webapp is an open-source front end for Wire, a secure collaboration platform. In wire-webapp before version 2021-03-15-production.0, wh CVE-2021-214017.1Nanopb is a small code-size Protocol Buffers implementation in ansi C. In Nanopb before versions 0.3.9.8 and 0.4.5, decoding a specifically CVE-2021-214026.5Jellyfin is a Free Software Media System. In Jellyfin before version 10.7.1, with certain endpoints, well crafted requests will allow arbitr CVE-2021-214039.8In github.com/kongchuanhujiao/server before version 1.3.21 there is an authentication Bypass by Primary Weakness vulnerability. All users ar CVE-2021-214047.5Syncthing is a continuous file synchronization program. In Syncthing before version 1.15.0, the relay server `strelaysrv` can be caused to c CVE-2021-214057.5Lotus is an Implementation of the Filecoin protocol written in Go. BLS signature validation in lotus uses blst library method VerifyCompress CVE-2021-214068.8Combodo iTop is an open source, web based IT Service Management tool. In versions prior to 2.7.4, there is a command injection vulnerability CVE-2021-214076.5Combodo iTop is an open source, web based IT Service Management tool. Prior to version 2.7.4, the CSRF token validation can be bypassed thro CVE-2021-214088.8Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.43 CVE-2021-214095.9Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance prot