Authenticated Cross-Site Scripting Issues in Shopizer eCommerce Platform
CVE-2026-36766

5.4MEDIUM

Key Information:

Vendor

Shopizer

Status
Shopizer
Vendor
CVE Published:
30 April 2026

What is CVE-2026-36766?

Shopizer v3.2.5 contains multiple authenticated cross-site scripting vulnerabilities within the XssHttpServletRequestWrapper class. These vulnerabilities can be exploited by attackers to inject malicious scripts or HTML, specifically through crafted payloads that target the getInputStream() and getReader() methods. This allows unauthorized execution of arbitrary web scripts, potentially compromising the security of the affected applications and their data.

References

https://github.com/shopizer-ecommerce/shopizer
https://github.com/shopizer-ecommerce/shopizer/issues/1093

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.