CVE-2025-51586
Presta Shop vulnerable to email enumeration
An issue was discoverd in file controllers/admin/AdminLoginController.php in PrestaShop before 8.2.1 allowing attackers to gain sensitive information via the reset password feature.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
An issue was discoverd in file controllers/admin/AdminLoginController.php in PrestaShop before 8.2.1 allowing attackers to gain sensitive information via the reset password feature.
- Record
CVE-2025-51586- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-359
- Updated
- 2026-11-02
EUVDEUVD-2025-27151
An issue was discoverd in file controllers/admin/AdminLoginController.php in PrestaShop before 8.2.1 allowing attackers to gain sensitive information via the reset password feature.
- Record
EUVD-2025-27151- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-8xx5-h6m3-jr33
Presta Shop vulnerable to email enumeration
Impact
An unauthenticated attacker with access to the back-office URL can manipulate the id_employee and reset_token parameters to enumerate valid back-office employee email addresses.
Impacted parties: Store administrators and employees: their email addresses are exposed. Merchants: risk of phishing, social engineering, and brute-force attacks targeting admin accounts.
Patches
PrestaShop 8.2.3
Workarounds
You must upgrade, or at least apply the changes from the PrestaShop 8.2.3 patch. More information: https://build.prestashop-project.org/news/2025/prestashop-8-2-3-security-release/
- Record
GHSA-8xx5-h6m3-jr33- CVSS 3.1
- 4.2 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-203, CWE-359
- Updated
- 2026-11-02
NVD
An issue was discoverd in file controllers/admin/AdminLoginController.php in PrestaShop before 8.2.1 allowing attackers to gain sensitive information via the reset password feature.
- Record
CVE-2025-51586- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-359
- Updated
- 2026-11-07
OSV
An issue was discoverd in file controllers/admin/AdminLoginController.php in PrestaShop before 8.2.1 allowing attackers to gain sensitive information via the reset password feature.
- Record
CVE-2025-51586- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-8xx5-h6m3-jr33
Presta Shop vulnerable to email enumeration
Impact
An unauthenticated attacker with access to the back-office URL can manipulate the id_employee and reset_token parameters to enumerate valid back-office employee email addresses.
Impacted parties: Store administrators and employees: their email addresses are exposed. Merchants: risk of phishing, social engineering, and brute-force attacks targeting admin accounts.
Patches
PrestaShop 8.2.3
Workarounds
You must upgrade, or at least apply the changes from the PrestaShop 8.2.3 patch. More information: https://build.prestashop-project.org/news/2025/prestashop-8-2-3-security-release/
- Record
GHSA-8xx5-h6m3-jr33- CVSS 3.1
- 4.2 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-203, CWE-359
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
prestashop/prestashopPackagist |
before 8.2.3 | 8.2.3 |
prestashop/prestashopPackagist |
before 8.2.3, plus listed versions 1.7.0.01.7.0.0-beta.1.01.7.0.0-beta.2.01.7.0.0-beta.3.01.7.0.0-beta.4.0 Show 45 moreShow less1.7.0.0-rc.0.01.7.0.0-rc.1.01.7.0.0-rc.2.01.7.0.11.7.0.21.7.0.31.7.0.41.7.0.51.7.0.61.7.1.01.7.1.11.7.1.21.7.2.01.7.2.0-rc.1.01.7.2.11.7.2.21.7.2.31.7.2.41.7.2.51.7.3.01.7.3.11.7.3.21.7.3.31.7.3.41.7.4.01.7.4.0-beta.11.7.4.11.7.4.21.7.4.31.7.4.41.7.5.01.7.5.0-beta.11.7.5.0-rc.11.7.5.11.7.5.21.7.6.01.7.6.0-beta.11.7.6.0-rc.11.7.6.0-rc.21.7.6.11.7.6.21.7.6.31.7.6.41.7.6.51.7.6.6 |
8.2.3 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | 7h30th3r0n3/CVE-2025-51586-PrestaShop-PoC | 2025-10-06 |
| Nuclei | PrestaShop - Information Disclosure |
History
| Recorded | Changed | Sources |
|---|---|---|
| exploits, facts | NVD | |
| first indexed | CVE List, EUVD, GitHub Advisories, Nuclei, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-51586 is a low vulnerability (CVSS 3.7) in Prestashop, published September 4, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.82%, the 57th percentile. Fixed in prestashop/prestashop 8.2.3.
References
prestashop.com
github.com/PrestaShop/PrestaShop/releases/tag/8.2.1
maxime-morel.github.io/advisories/2025/CVE-2025-51586.md
build.prestashop-project.org/news/2025/prestashop-8-2-3-security-release
Left out here: 50 versions. The JSON record has them.