CVE-2024-58296: CVE-2024-58296: siteler arası betik çalıştırma (XSS)

Açıklama (NVD)

CE Phoenix v1.0.8.20 contains a stored cross-site scripting vulnerability in the currencies administration panel that allows attackers to inject malicious scripts. Attackers can insert XSS payloads in the title field to execute arbitrary JavaScript when administrators view the currencies page.

Özet bilgiler

CVSS v4.0

5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS

%0,37 (yüzdelik 31)

CWE

CWE-79

Yama

Yok / bilinmiyor

Kaynaklar

• NVD kaydı
• demos6.softaculous.com
• phoenixcart.org
• www.exploit-db.com
• www.softaculous.com
• www.vulncheck.com
• CWE-79