Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "tracking_number" parameter,
potentially leading to unauthorized execution of scripts within a user's web browser.
References
Link | Resource |
---|---|
https://fluidattacks.com/advisories/bts/ | Exploit Third Party Advisory |
https://www.oscommerce.com/ | Product |
Configurations
History
02 Oct 2023, 20:13
Type | Values Removed | Values Added |
---|---|---|
References | (MISC) https://www.oscommerce.com/ - Product | |
References | (MISC) https://fluidattacks.com/advisories/bts/ - Exploit, Third Party Advisory | |
First Time |
Oscommerce
Oscommerce oscommerce |
|
CPE | cpe:2.3:a:oscommerce:oscommerce:4.12.56860:*:*:*:*:*:*:* | |
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.4 |
CWE | CWE-79 |
30 Sep 2023, 02:50
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2023-09-30 02:15
Updated : 2024-02-28 20:33
NVD link : CVE-2023-43702
Mitre link : CVE-2023-43702
CVE.ORG link : CVE-2023-43702
JSON object : View
Products Affected
oscommerce
- oscommerce
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')