{"id":"GHSA-58w4-w77w-qv3w","aliases":["CVE-2020-26225"],"title":"Reflected XSS with parameters in PostComment","description":"### Impact\nAn attacker could inject malicious web code into the users' web browsers by creating a malicious link.\n\n### Patches\nThe problem is fixed in 4.2.0\n\n### References\n[Cross-site Scripting (XSS) - Reflected (CWE-79) ](https://cwe.mitre.org/data/definitions/79.html)","severity":"high","score":8.7,"published":"2020-11-16T21:23:29.000Z","modified":"2026-09-10T03:48:36.205Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"prestashop/productcomments","ranges":[{"events":[{"introduced":"4.0.0"},{"fixed":"4.2.0"}],"type":"ECOSYSTEM"}],"versions":["v4.0.0","v4.0.1","v4.1.0"],"fixed":["4.2.0"]}],"references":["https://github.com/PrestaShop/productcomments/security/advisories/GHSA-58w4-w77w-qv3w","https://nvd.nist.gov/vuln/detail/CVE-2020-26225","https://github.com/PrestaShop/productcomments/commit/c56e3e9495c4a0a9c1e7dc43e1bb0fcad2796dbf"],"sources":[{"name":"OSV","id":"GHSA-58w4-w77w-qv3w","modified":"2026-09-10T03:48:36.205506747Z","url":"https://osv.dev/vulnerability/GHSA-58w4-w77w-qv3w"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","score":8.7}]}