Cross-site Scripting in shuup

2021-10-0420:11:03

Google

osv.dev

0.001 Low

EPSS

Percentile

31.4%

JSON

In Shuup, versions 1.6.0 through 2.10.8 are vulnerable to reflected Cross-Site Scripting (XSS) that allows execution of arbitrary javascript code on a victim browser. This vulnerability exists due to the error page contents not escaped.

CPENameOperatorVersion
shuupeq2.8.3
shuupeq1.6.3
shuupeq2.10.1
shuupeq1.10.1
shuupeq1.9.9
shuupeq1.6.9
shuupeq1.10.8
shuupeq1.7.1
shuupeq2.3.18
shuupeq2.3.8