Cross-Site Scripting Vulnerability in EC-CUBE Management Portal

CVE-2023-40281

What is CVE-2023-40281?

EC-CUBE versions 2.11.0 to 2.17.2-p1 are affected by a cross-site scripting vulnerability in the 'mail/template' and 'products/product' sections of the management page. When exploited, this vulnerability allows an attacker to inject arbitrary scripts, potentially compromising the web browser of the administrators or users accessing the website. Ensuring proper validation and sanitization of user inputs is crucial to mitigate such vulnerabilities.

References