CVE-2025-51586

An issue was discoverd in file controllers/admin/AdminLoginController.php in PrestaShop before 8.2.1 allowing attackers to gain sensitive information via the reset password feature.

CVSS v3.1 CNA

3.7 LOWCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS v3.1 GitHub

4.2 MEDIUMCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

EPSS

0.82% chance of exploitation in the next 30 days, 56th percentile

Nuclei

medium · CWE-359

Published

2025-09-08

Proof-of-concept exploits (1)

• 7h30th3r0n3/CVE-2025-51586-PrestaShop-PoC1★ · 2025-11-03

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-51586.yaml

Security advisories

• https://maxime-morel.github.io/advisories/2025/CVE-2025-51586.md
• advisories/GHSA-8xx5-h6m3-jr33
• PrestaShop/PrestaShop/releases/tag/8.2.1
• https://prestashop.com

References

• CVE Record
• NVD entry

Related

• CVE-2026-53625
• CVE-2026-9082