Описание
The CleanseMessage function in shop$db.asp for VP-ASP Shopping Cart 4.0 through 5.0 does not sufficiently cleanse inputs, which allows remote attackers to conduct cross-site scripting (XSS) attacks that do not use
Ссылки
- ExploitPatchVendor Advisory
- Vendor Advisory
- ExploitPatchVendor Advisory
- Patch
- ExploitPatch
- Patch
- ExploitPatchVendor Advisory
- Vendor Advisory
- ExploitPatchVendor Advisory
- Patch
- ExploitPatch
- Patch
Уязвимые конфигурации
Конфигурация 1
Одно из
cpe:2.3:a:virtual_programming:vp-asp:4.0:*:*:*:*:*:*:*
cpe:2.3:a:virtual_programming:vp-asp:4.50:*:*:*:*:*:*:*
cpe:2.3:a:virtual_programming:vp-asp:5.0:*:*:*:*:*:*:*
EPSS
Процентиль: 78%
0.01178
Низкий
4.3 Medium
CVSS2
Дефекты
NVD-CWE-Other
Связанные уязвимости
github
почти 4 года назад
The CleanseMessage function in shop$db.asp for VP-ASP Shopping Cart 4.0 through 5.0 does not sufficiently cleanse inputs, which allows remote attackers to conduct cross-site scripting (XSS) attacks that do not use <script> tags, as demonstrated via javascript in IMG tags to (1) the cat parameter in shopdisplayproducts.asp or (2) the msg parameter in shoperror.asp, and possibly other vectors.
EPSS
Процентиль: 78%
0.01178
Низкий
4.3 Medium
CVSS2
Дефекты
NVD-CWE-Other