HTML Injection Vulnerability in OpenCart by OpenCart
CVE-2025-1747
4.7MEDIUM
Summary
HTML injection vulnerabilities in OpenCart allow attackers to manipulate the HTML content displayed in the victim's browser. Specifically, by crafting a malicious URL that alters the parameter name within the /account/login route, an attacker can execute unauthorized script code. This can potentially lead to unauthorized access or the execution of malicious scripts in the context of the user’s session, compromising sensitive information.
Affected Version(s)
OpenCart 0 < 4.1.0
References
CVSS V3.1
Score:
4.7
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Gonzalo Aguilar GarcĂa (6h4ack)