Vulnerability Details CVE-2022-38975
DOM-based cross-site scripting vulnerability in EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.1.2) allows a remote attacker to inject an arbitrary script by having an administrative user of the product to visit a specially crafted page.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 50.6%
CVSS Severity
CVSS v3 Score 5.4
References
Products affected by CVE-2022-38975
-
cpe:2.3:a:ec-cube:ec-cube:4.0.0
-
cpe:2.3:a:ec-cube:ec-cube:4.0.1
-
cpe:2.3:a:ec-cube:ec-cube:4.0.2
-
cpe:2.3:a:ec-cube:ec-cube:4.0.3
-
cpe:2.3:a:ec-cube:ec-cube:4.0.5
-
cpe:2.3:a:ec-cube:ec-cube:4.0.6
-
cpe:2.3:a:ec-cube:ec-cube:4.1.0
-
cpe:2.3:a:ec-cube:ec-cube:4.1.1
-
cpe:2.3:a:ec-cube:ec-cube:4.1.2