{"action":"Upgrade prestashop/productcomments to 4.2.1 or later.","affected":[{"fixed":"4.2.1","introduced":"4.0.0"}],"component":"prestashop/productcomments","cve_ids":["CVE-2020-26248"],"ecosystem":"Packagist","epss":0.12388,"exploited":false,"fixed_versions":["4.2.1"],"ghsa_id":"GHSA-5v44-7647-xfw9","id":"tcs_01M5KEWCKBPQGT9RSJZ76Q2P2W","modified_at":"2026-07-08T06:28:40.655775242Z","published_at":"2021-01-20T21:33:53Z","references":["https://osv.dev/vulnerability/GHSA-5v44-7647-xfw9","https://github.com/PrestaShop/productcomments/security/advisories/GHSA-5v44-7647-xfw9","https://nvd.nist.gov/vuln/detail/CVE-2020-26248","https://github.com/PrestaShop/productcomments/commit/7c2033dd811744e021da8897c80d6c301cd45ffa","https://github.com/PrestaShop/productcomments","https://github.com/PrestaShop/productcomments/releases/tag/v4.2.1","https://packagist.org/packages/prestashop/productcomments","http://packetstormsecurity.com/files/160539/PrestaShop-ProductComments-4.2.0-SQL-Injection.html"],"severity":{"label":"high","score":8.2},"sources":[{"source":"osv","source_id":"GHSA-5v44-7647-xfw9","url":"https://osv.dev/vulnerability/GHSA-5v44-7647-xfw9"}],"summary":"Blind SQL injection in PrestaShop productcomments module"}