Ps Facetedsearch
Approved changes feed: RSS · Atom
cpe:2.3:a:prestashop:ps_facetedsearch:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Prestashop (236a7260-6e18-5f0f-b33a-a013be210d8c) |
|---|---|
| Product | Ps Facetedsearch (5ca649e2-5c25-55c2-9831-fca170023c2b) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-54159 |
vulnerable | 2026-07-29 01:00:27.605129 |
ps_facetedsearch: PHP Object Injection in faceted search cache allows unauthenticated RCE
CRITICAL (10)
PrestaShop ps_facetedsearch is a module that adds layered navigation filters. From 3.0.0 until 4.0.4, the ps_facetedsearch module rebuilds selected search filters from the request URL, and the value of a slider filter, price or weight, is taken from the URL without sufficient validation and stored in an internal filter-block cache where it is serialized and later read back with a raw native unserialize() in src/Filters/Block.php. By crafting that value, an unauthenticated attacker can smuggle a malicious serialized PHP object into the cache, and when it is deserialized, a gadget chain writes an arbitrary PHP file inside the modules/ps_facetedsearch/ directory, which is then used as a webshell to run commands on the server. This issue is fixed in version 4.0.4.
Published: 2026-07-17T20:39:25.838Z
Updated: 2026-07-20T13:56:07.400Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-5277 |
vulnerable | 2026-06-08 05:26:41.656341 |
Reflected XSS with url_name parameter of PrestaShop module ps_facetedsearch
MEDIUM (4.1)
PrestaShop module ps_facetedsearch versions before 3.5.0 has a reflected XSS with `url_name` parameter. The problem is fixed in 3.5.0
Published: 2020-03-25T18:30:15.000Z
Updated: 2024-08-04T08:22:09.180Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.