CVE-2023-40281

CVE-2023-40281: vulnerability in EC-CUBE 2 series

Published · Updated

Follow this CVE+ Monitor EC-CUBE 2 series

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 0.4%
EC-CUBE 2.11.0 to 2.17.2-p1 contain a cross-site scripting vulnerability in "mail/template" and "products/product" of Management page. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the other administrator or the user who accessed the website using the product.
Affected products
EC-CUBE CO.,LTD. · EC-CUBE 2 series
Related CVEs — EC-CUBE 2 series

In the same product, most dangerous first.

CVE-2021-20841—CVE-2021-20841EPSS 1.3%CVE-2021-20842—CVE-2021-20842EPSS 0.6%