Cross-Site Scripting Vulnerability in Ecommerce-CodeIgniter-Bootstrap
CVE-2021-40975

6.1MEDIUM

Key Information:

Vendor

Ecommerce-codeigniter-bootstrap Project

Status
Ecommerce-codeigniter-bootstrap
Vendor
CVE Published:
1 October 2021

What is CVE-2021-40975?

A cross-site scripting vulnerability exists in the Ecommerce-CodeIgniter-Bootstrap application that allows remote attackers to inject arbitrary web scripts or HTML via the 'search_title' parameter located in the products.php file. This exploitation can potentially lead to unauthorized actions or data exposure, emphasizing the necessity for immediate assessment and mitigation strategies for affected versions.

References

https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Boot...
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.