CVEvulnerability

CVE-2024-58304

5.3 MEDIUM Published 2025-12-11 Modified 2026-10-27 Official page ↗

Status: Deferred
Published: 2025-12-11
Last modified: 2026-10-27
Assigner: [email protected]
CVSS 4.0 ([email protected]): 5.3 MEDIUM — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1 ([email protected]): 6.1 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses: CWE-79

Description

SPA-CART CMS before 2.0.0 contains a stored cross-site scripting vulnerability in the product description parameter that allows authenticated administrators to inject malicious scripts. Attackers can submit JavaScript payloads through the 'descr' parameter in the product edit form to execute arbitrary code in administrative users' browsers.

Weakness · CWE (1)

CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References

https://github.com/olegkhorev/php-spa-cart/releases/tag/v2.0.0 github.com
https://www.exploit-db.com/exploits/51919 www.exploit-db.com
https://www.vulncheck.com/advisories/spa-cart-cms-stored-cross-site-scripting-via-product-description www.vulncheck.com

CVE-2024-58304

Description

Related

Weakness · CWE (1)

References