CVE-2025-51586

MEDIUM4.2EPSS 0.94%

Presta Shop vulnerable to email enumeration

Published: 9/4/2025Modified: 9/15/2025

Description

An issue was discoverd in file controllers/admin/AdminLoginController.php in PrestaShop before 8.2.1 allowing attackers to gain sensitive information via the reset password feature.

Affected packages (2)

Bitnami/prestashopfrom 0, < 8.2.1
Packagist/prestashop/prestashopfrom 0, < 8.2.3

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	MEDIUM4.2	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

References (10)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2025-51586
PATCHhttps://github.com/PrestaShop/PrestaShop
WEBhttps://build.prestashop-project.org/news/2025/prestashop-8-2-3-security-release
WEBhttps://github.com/PrestaShop/PrestaShop/commit/c97bdf10f77fedbe5a61a1dec5f96b3abb1d76fb
WEBhttps://github.com/PrestaShop/PrestaShop/releases/tag/8.2.1
WEBhttps://github.com/PrestaShop/PrestaShop/releases/tag/8.2.3
WEBhttps://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-8xx5-h6m3-jr33
WEBhttps://maxime-morel.github.io/advisories/2025/CVE-2025-51586.md
WEBhttps://prestashop.com
WEBhttps://prestashop.com/