CVE-2021-33562

Katalog CVE

CVSS 4.8 · Medium EPSS 2,9%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada shopizer. Skor CVSS 3.1 4.8 (Medium) menurut NVD.

Deskripsi (NVD)

A reflected cross-site scripting (XSS) vulnerability in Shopizer before 2.17.0 allows remote attackers to inject arbitrary web script or HTML via the ref parameter to a page about an arbitrary product, e.g., a product/insert-product-name-here.html/ref= URL.

Rincian

Terbit di NVD

24 Mei 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.8 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

2,9% peluang dieksploitasi; lebih tinggi dari 86,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/shopizer-ecommerce/shopizer/commit/197f8c78c8f673b957e41ca2c823afc654c19271 patch · advisory pihak ketiga
• https://github.com/shopizer-ecommerce/shopizer/compare/2.16.0...2.17.0 patch · advisory pihak ketiga
• https://www.exploit-db.com/exploits/49901 exploit · advisory pihak ketiga · vdb entry