CVE-2025-51586

3.7

CVSSlow

Exploitable remotely over the internet · no authentication required.

Description

An issue was discoverd in file controllers/admin/AdminLoginController.php in PrestaShop before 8.2.1 allowing attackers to gain sensitive information via the reset password feature.

Attack Vector

Network

Privileges Req.

None

User Interaction

None

Updated Nov 10, 2026View on NVD →

S4E scanner

mediumMisconfiguration~10 seconds

PrestaShop - Information Disclosure

User enumeration vulnerability in the AdminLogin controller in PrestaShop 1.7 through 8.2.2 allows remote attackers to obtain administrators user email addresses via manipulation of the id_employee and reset_token parameters. An attacker who has access to the Back Office login URL can trigger the password reset form to disclose the associated email address in a hidden field, even when the provided reset token is invalid. This issue has been fixed in 8.2.3. References: https://maxime-morel.github.io/advisories/2025/CVE-2025-51586.md https://security.friendsofpresta.org/core/2025/09/04/CVE-2025-51586.html https://nvd.nist.gov/vuln/detail/CVE-2025-51586

Used 20 times · 10 assets checked · domain, subdomain, ipv4

Scanner page →Run scanner

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →