AUGUST 4, 2026
Live Feed
Back to database
Case File

CVE-2025-69633

CRITICAL · CVSS 9.8 EPSS 0.36%

Source: NVD + CISA KEV + EPSS (historical backfill) · Published 2026-02-13 · Last synced 2026-08-04

CyberRota Analysis

This is a critical severity vulnerability with a CVSS score of 9.8. It may be remotely exploitable. It involves a SQL injection risk. Exploitation may require the attacker to be authenticated.

CVE
CVE-2025-69633
Severity
CRITICAL
CVSS
9.8
EPSS
0.36%

Original NVD Description

A SQL Injection vulnerability in the Advanced Popup Creator (advancedpopupcreator) module for PrestaShop 1.1.26 through 1.2.6 (Fixed in version 1.2.7) allows remote unauthenticated attackers to execute arbitrary SQL queries via the fromController parameter in the popup controller. The parameter is passed unsanitized to SQL queries in classes/AdvancedPopup.php (getPopups() and updateVisits() functions).