Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "featured_type_name[1]" parameter,
potentially leading to unauthorized execution of scripts within a user's web browser.
References
Link | Resource |
---|---|
https://fluidattacks.com/advisories/bts/ | Exploit Third Party Advisory |
https://www.oscommerce.com/ | Product |
Configurations
History
02 Oct 2023, 20:25
Type | Values Removed | Values Added |
---|---|---|
First Time |
Oscommerce
Oscommerce oscommerce |
|
CWE | CWE-79 | |
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.4 |
CPE | cpe:2.3:a:oscommerce:oscommerce:4.12.56860:*:*:*:*:*:*:* | |
References | (MISC) https://www.oscommerce.com/ - Product | |
References | (MISC) https://fluidattacks.com/advisories/bts/ - Exploit, Third Party Advisory |
30 Sep 2023, 23:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2023-09-30 23:15
Updated : 2024-02-28 20:33
NVD link : CVE-2023-5111
Mitre link : CVE-2023-5111
CVE.ORG link : CVE-2023-5111
JSON object : View
Products Affected
oscommerce
- oscommerce
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')