CVE-2024-6526

Katalog CVE

CVSS 6.1 · Medium EPSS 0,52%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada ecommerce-codeigniter-bootstrap project ecommerce-codeigniter-bootstrap. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

A vulnerability classified as problematic has been found in CodeIgniter Ecommerce-CodeIgniter-Bootstrap up to 1998845073cf433bc6c250b0354461fbd84d0e03. This affects an unknown part. The manipulation of the argument search_title/catName/sub/name/categorie leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 1b3da45308bb6c3f55247d0e99620b600bd85277. It is recommended to apply a patch to fix this issue. The identifier VDB-270369 was assigned to this vulnerability.

Rincian

Terbit di NVD

5 Juli 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,52% peluang dieksploitasi; lebih tinggi dari 42,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap/commit/1b3da45308bb6c3f55247d0e99620b600bd85277 patch
• https://vuldb.com/?id.270369 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.368472 exploit · advisory pihak ketiga · vdb entry
• https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap/issues/263 exploit · issue tracking
• https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap/issues/263#issuecomment-2199387443 exploit · issue tracking
• https://vuldb.com/?ctiid.270369 permissions required · vdb entry