CVE-2026-14846
2026-07-13
10h16 +00:00
10h16 +00:00
指定 CVE 通知
随时了解指定 CVE 的变更。
CVE 描述
In version 8.2.1 of PrestaShop, there is a vulnerability relating to the incorrect sanitisation of elements, caused by inadequate validation of the ‘Alias’ parameter in the ‘Update your address’ function. This flaw allows an attacker to inject malicious expressions that are executed when the information is exported using the ‘Get my data in CSV’ tool. Successful exploitation of this vulnerability could facilitate unauthorised access to the victim’s personal data.
CVE 信息
相关弱点
| 弱点名称 | 来源 | |
|---|---|---|
| Improper Neutralization of Formula Elements in a CSV File The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product. |
