A perfectly up-to-date store stays exposed through its modules: no PrestaShop update fixes them, and not every vendor ships a patch.
that is 263 vulnerabilities out of 312 we block, fix, or both.
100 vulnerabilities found by our own team on commercial modules, across 82 different modules. None carries a public CVE reference: they exist nowhere else.
We publish neither the module name, nor the vector, nor how to exploit them. The vendor has not always shipped a fix, and the detail would expose every store running those modules — including stores that are not our customers. Our customers are protected without waiting for the flaw to become public.
Module concerned: · Vector:
Core vulnerabilities depend on your version. An abandoned branch will never receive the fixes published since.
The count at the top of this page is computed from the same database that feeds our scans, not typed by hand: it moves when an advisory is published or withdrawn.
That a flaw is covered in at least one of two ways: our firewall blocks the attack request before it reaches the store, or we wrote a patch that closes the flaw inside the module files. Vulnerabilities covered by neither appear hollow on the chart — we do not hide them.
No, and that is the useful difference. Updating assumes the vendor released a fixed version, that it is compatible with your store, and that you can install it. Our patch works on the files of the version you already run: it closes the flaw without a version change, without regression risk on your theme, and it is reversible.
Because they are our own, unpublished discoveries. Naming the module would be pointing at a target: the vendor has not always shipped a fix, and every affected store would become vulnerable to the first researcher who looks. Our customers are protected without waiting for publication.
They are recomputed at every synchronisation of our advisory database, and the timestamp at the bottom of the page shows the last one.
This page lists the flaws known across the market. Knowing which are actually installed on your store requires a scan of your files and modules.
Two-minute install. 14-day money-back, no questions asked.
Most of this catalogue comes from FriendsOfPresta and the GitHub Advisory database. We map it to the versions actually affected, we write the patches that are missing, and we test what our firewall blocks.
