CVE-2025-61922Critical· 9.1▾ AbyssalPoC availablePrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal. Starting in version 1.3.0 and prior to versions 4.4.1 and 5.0.5, missing validation on the Express Checkout feature allows silent login, enabling a…
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 50.1 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.5%
2 GitHub repos (last check)
PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal. Starting in version 1.3.0 and prior to versions 4.4.1 and 5.0.5, missing validation on the Express Checkout feature allows silent login, enabling account takeover via email. The vulnerability is fixed in versions 4.4.1 and 5.0.5. No known workarounds exist.
prestashop_checkout >= 1.3.0, < 7.4.4.1prestashop_checkout >= 7.5.0.1, < 7.5.0.5prestashop_checkout >= 8.3.1.0, < 8.4.4.1prestashop_checkout >= 8.5.0.0, < 8.5.0.5prestashop_checkout >= 9.4.3.1, < 9.5.0.5Upgrade past the affected range:
prestashop_checkout 9.5.0.5Connected by shared product, vendor, weakness, or advisory.
CVE-2025-61924Low· 3.8PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal
CVE-2025-61923Medium· 4.1PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal
CVE-2023-49105Critical· 9.8An issue was discovered in ownCloud owncloud/core before 10.13.1
CVE-2022-40684Critical· 9.8An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 …
CVE-2023-35078Critical· 9.8An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the application without proper authentication.
CVE-2026-92809Medium· 4.3PrestaShop psgdpr versions through 1.4.3 fail to validate that GDPR consent log entries are attributed to the authenticated customer