{"id":"GHSA-j33m-2537-86jm","aliases":["CVE-2012-20001"],"title":"PrestaShop XSS Vulnerability","description":"PrestaShop before 1.5.2.0 allows XSS via the `<object data='data:text/html` substring in the message field.","severity":"medium","score":6.1,"published":"2022-04-23T00:40:51.000Z","modified":"2023-11-08T03:57:04.458Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"prestashop/prestashop","ranges":[{"events":[{"introduced":"0"},{"fixed":"1.5.2.0"}],"type":"ECOSYSTEM"}],"versions":[],"fixed":["1.5.2.0"]}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2012-20001","https://seclists.org/bugtraq/2012/Nov/1","https://web.archive.org/web/20140803034142/http://forge.prestashop.com/browse/PSCFV-5204","https://web.archive.org/web/20160305224628/http://davidsopas.com/labs/prestashop_xss.txt"],"sources":[{"name":"OSV","id":"GHSA-j33m-2537-86jm","modified":"2023-11-08T03:57:04.458058Z","url":"https://osv.dev/vulnerability/GHSA-j33m-2537-86jm"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","score":6.1}]}