CVE-2023-43720

Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS)

Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability. This vulnerability allows attackers to inject JS through the "BILLING_GENDER_TITLE[1]" parameter, potentially leading to unauthorized execution of scripts within a user's web browser.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Oscommerce

Products

Oscommerce

CVE-2023-43719

Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS)

Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability. This vulnerability allows attackers to inject JS through the "SHIPPING_GENDER_TITLE[1]" parameter, potentially leading to unauthorized execution of scripts within a user's web browser.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Oscommerce

Products

Oscommerce

CVE-2023-43718

Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS)

Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability. This vulnerability allows attackers to inject JS through the "MSEARCH_ENABLE_TITLE[1]" parameter, potentially leading to unauthorized execution of scripts within a user's web browser.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Oscommerce

Products

Oscommerce

CVE-2023-43717

Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS)

Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability. This vulnerability allows attackers to inject JS through the "MSEARCH_HIGHLIGHT_ENABLE_TITLE[1]" parameter, potentially leading to unauthorized execution of scripts within a user's web browser.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Oscommerce

Products

Oscommerce

CVE-2023-43716

Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS)

Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability. This vulnerability allows attackers to inject JS through the "MAX_DISPLAY_NEW_PRODUCTS_TITLE[1]" parameter, potentially leading to unauthorized execution of scripts within a user's web browser.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Oscommerce

Products

Oscommerce

CVE-2023-43715

Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS)

Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability. This vulnerability allows attackers to inject JS through the "ENTRY_FIRST_NAME_MIN_LENGTH_TITLE[1]" parameter, potentially leading to unauthorized execution of scripts within a user's web browser.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Oscommerce

Products

Oscommerce

CVE-2023-43714

Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS)

Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability. This vulnerability allows attackers to inject JS through the "SKIP_CART_PAGE_TITLE[1]" parameter, potentially leading to unauthorized execution of scripts within a user's web browser.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Oscommerce

Products

Oscommerce

CVE-2023-43713

Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS)

Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability, which allows attackers to inject JS via the "title" parameter, in the "/admin/admin-menu/add-submit" endpoint, which can lead to unauthorized execution of scripts in a user's web browser.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Oscommerce

Products

Oscommerce

CVE-2023-43712

Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS)

Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability. This vulnerability allows attackers to inject JS through the "access_levels_name" parameter, potentially leading to unauthorized execution of scripts within a user's web browser.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Oscommerce

Products

Oscommerce

CVE-2023-43711

Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS)

Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability. This vulnerability allows attackers to inject JS through the "admin_firstname" parameter, potentially leading to unauthorized execution of scripts within a user's web browser.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Oscommerce

Products

Oscommerce

CVE-2023-43710

Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS)

Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability. This vulnerability allows attackers to inject JS through the "configuration_title[1][MODULE_SHIPPING_PERCENT_TEXT_TITLE]" parameter, potentially leading to unauthorized execution of scripts within a user's web browser.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Oscommerce

Products

Oscommerce

CVE-2023-43709

Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS)

Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability. This vulnerability allows attackers to inject JS through the "configuration_title[1](MODULE)" parameter, potentially leading to unauthorized execution of scripts within a user's web browser.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Oscommerce

Products

Oscommerce

CVE-2023-43708

Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS)

Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability. This vulnerability allows attackers to inject JS through the "configuration_title[1](MODULE_PAYMENT_SAGE_PAY_SERVER_TEXT_TITLE)" parameter, potentially leading to unauthorized execution of scripts within a user's web browser.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Oscommerce

Products

Oscommerce

CVE-2023-43707

Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS)

Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability. This vulnerability allows attackers to inject JS through the "CatalogsPageDescriptionForm[1][name] " parameter, potentially leading to unauthorized execution of scripts within a user's web browser.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Oscommerce

Products

Oscommerce

CVE-2023-43706

Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS)

Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability. This vulnerability allows attackers to inject JS through the "email_templates_key" parameter, potentially leading to unauthorized execution of scripts within a user's web browser.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Oscommerce

Products

Oscommerce

CVE-2023-43705

Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS)

Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability. This vulnerability allows attackers to inject JS through the "translation_value[1]" parameter, potentially leading to unauthorized execution of scripts within a user's web browser.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Oscommerce

Products

Oscommerce

CVE-2023-43704

Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS)

Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability. This vulnerability allows attackers to inject JS through the "title" parameter, potentially leading to unauthorized execution of scripts within a user's web browser.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Oscommerce

Products

Oscommerce

CVE-2023-43703

Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS)

Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability. This vulnerability allows attackers to inject JS through the "product_info[][name]" parameter, potentially leading to unauthorized execution of scripts within a user's web browser.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Oscommerce

Products

Oscommerce

CVE-2023-43702

Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS)

Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability. This vulnerability allows attackers to inject JS through the "tracking_number" parameter, potentially leading to unauthorized execution of scripts within a user's web browser.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Oscommerce

Products

Oscommerce

CVE-2023-43701

Apache Superset: Stored XSS on API endpoint

Improper payload validation and an improper REST API response type, made it possible for an authenticated malicious actor to store malicious code into Chart's metadata, this code could get executed if a user specifically accesses a specific deprecated API endpoint. This issue affects Apache Superset versions prior to 2.1.2.  Users are recommended to upgrade to version 2.1.2, which fixes this issue.

CVSS 3.1 · 4.3 Medium EPSS 1.0% KEV · Not listed

Vendors

Apache

Products

Superset