CE Phoenix v3.0.1 Stored Cross-Site Scripting via admin/currencies.php
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.4%
probabilidade de exploração
0.4%top 69% das CVEs
exploração observada
nãonenhuma fonte reporta
CE Phoenix v3.0.1 contains a stored cross-site scripting vulnerability in the currencies administration panel that allows attackers to inject malicious scripts. Attackers can insert XSS payloads in the title field to execute arbitrary JavaScript when administrators view the currencies page.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Produtos afetados
PhoenixCart · CE PhoenixReferências
https://demos6.softaculous.com/CE_Phoenixx3r6jqi4kl/admin/currencies.phphttps://phoenixcart.org/https://www.exploit-db.com/exploits/52015https://www.softaculous.com/apps/ecommerce/CE_Phoenixhttps://www.vulncheck.com/advisories/ce-phoenix-v-stored-cross-site-scripting-via-currencies-administration