Vulnerability Details CVE-2022-27436
A cross-site scripting (XSS) vulnerability in /public/admin/index.php?add_user at Ecommerce-Website v1.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username text field.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 62.3%
CVSS Severity
CVSS v3 Score 4.8
CVSS v2 Score 3.5
References
- https://drive.google.com/file/d/1pXCq3E-OlczLs5Obh_qkJlJ-7kPkluEK/view?usp=sharing
- https://github.com/D4rkP0w4r/Full-Ecommece-Website-Add_User-Stored-XSS-POC
- https://hackmd.io/MUKHOiNkT2u9vi2u9CtrYA
- https://drive.google.com/file/d/1pXCq3E-OlczLs5Obh_qkJlJ-7kPkluEK/view?usp=sharing
- https://github.com/D4rkP0w4r/Full-Ecommece-Website-Add_User-Stored-XSS-POC
- https://hackmd.io/MUKHOiNkT2u9vi2u9CtrYA
Products affected by CVE-2022-27436
-
cpe:2.3:a:ecommerce-website_project:ecommerce-website:1.1.0