Skip to content
Fencer Intel
medium 4.3

CVE-2011-4544 json

Multiple cross-site scripting (XSS) vulnerabilities in Prestashop before 1.5 allow remote attackers to inject arbitrary web script or HTML…

published 2011-12-01 14 y ago modified 2026-06-16 4 mo ago also EUVD-2011-4470

cvss
4.3
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
3.1%
EPSS 3.1% chance of exploitation in 30 days, percentile 87%
public exploits
4
Exploit-DB

Summary

Multiple cross-site scripting (XSS) vulnerabilities in Prestashop before 1.5 allow remote attackers to inject arbitrary web script or HTML via the (1) address or (2) relativ_base_dir parameter to modules/mondialrelay/googlemap.php; the (3) relativ_base_dir, (4) Pays, (5) Ville, (6) CP, (7) Poids, (8) Action, or (9) num parameter to prestashop/modules/mondialrelay/googlemap.php; (10) the num_mode parameter to modules/mondialrelay/kit_mondialrelay/RechercheDetailPointRelais_ajax.php; (11) the Expedition parameter to modules/mondialrelay/kit_mondialrelay/SuiviExpedition_ajax.php; or the (12) folder or (13) name parameter to admin/ajaxfilemanager/ajax_save_text.php.

Timeline

  1. First public exploit (EDB-36344)
  2. Published

Exploit prediction

3.13% chance of exploitation in the next 30 days, higher than 87% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • EDB-36344 PrestaShop 1.4.4.1 - '/admin/ajaxfilemanager/ajax_save_text.php' Multiple Cross-Site Scripting Vulnerabilities webapps, 2011-11-23
  • EDB-36343 PrestaShop 1.4.4.1 - '/modules/mondialrelay/kit_mondialrelay/SuiviExpedition_ajax.php?Expedition' Cross-Site Scripting webapps, 2011-11-23
  • EDB-36342 PrestaShop 1.4.4.1 - '/modules/mondialrelay/googlemap.php' Multiple Cross-Site Scripting Vulnerabilities webapps, 2011-11-23
  • EDB-36341 PrestaShop 1.4.4.1 mondialrelay (kit_mondialrelay) - Multiple Cross-Site Scripting Vulnerabilities webapps, 2011-11-23
  • dognaedis.com https://www.dognaedis.com/vulns/DGS-SEC-6.html referenced PoC, tagged "exploit" by a source, unverified
  • dognaedis.com https://www.dognaedis.com/vulns/DGS-SEC-5.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.