SQL Injection Vulnerability in Advanced Popup Creator for PrestaShop
CVE-2025-69633

9.8CRITICAL

Key Information:

Vendor

PrestaShop

Status
Advanced Popup Creator
Vendor
CVE Published:
13 February 2026

What is CVE-2025-69633?

A SQL Injection vulnerability exists in the Advanced Popup Creator module for PrestaShop, enabling remote attackers to perform arbitrary SQL queries. The issue arises due to the unsanitized handling of the 'fromController' parameter within the popup controller. This flaw affects versions 1.1.26 to 1.2.6 of the module and can lead to unauthorized access and data manipulation. Users are advised to upgrade to version 1.2.7 or later to mitigate this risk.

References

https://addons.prestashop.com/en/pop-up-gamification/2377...
https://labs.esokia.com/cve/cve-2025-69633/

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.