Shopizer is vulnerable to Cross-site Scripting

Multiple authenticated cross-site scripting XSS vulnerabilities in the XssHttpServletRequestWrapper class of shopizer through version 3.2.5 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the getInputStream or getReader functions...

GHSA-FQCW-2XHJ-P63G Shopizer is vulnerable to Cross-site Scripting

Multiple authenticated cross-site scripting XSS vulnerabilities in the XssHttpServletRequestWrapper class of shopizer through version 3.2.5 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the getInputStream or getReader functions...

CVE-2026-36766

CVE-2026-36766 describes multiple authenticated XSS vulnerabilities in the XssHttpServletRequestWrapper class of Shopizer v3.2.5. The issue allows attackers to execute arbitrary web scripts or HTML by injecting a crafted payload through getInputStream() or getReader(). The CVE entry notes the att...

Shopizer 跨站脚本漏洞

Shopizer is an open-source e-commerce solution developed by the Shopizer team, based on Java. Version 3.2.5 of Shopizer contains a cross-site scripting vulnerability. This vulnerability stems from the XssHttpServletRequestWrapper class, which has multiple authenticated cross-site scripting...

CVE-2025-13805

A weakness has been identified in nutzam NutzBoot up to 2.6.0-SNAPSHOT. This affects the function getInputStream of the file nutzcloud/nutzcloud-literpc/src/main/java/org/nutz/boot/starter/literpc/impl/endpoint/http/HttpServletRpcEndpoint.java of the component LiteRpc-Serializer. Executing a...

CVE-2025-13805

CVE-2025-13805 affects nutzam NutzBoot up to 2.6.0-SNAPSHOT via the LiteRpc-Serializer’s HttpServletRpcEndpoint.getInputStream, enabling deserialization of untrusted data. Described as remote and high-complexity, with exploit code publicly available. No fixed version is identified; monitoring for...

NutzBoot 代码问题漏洞

NutzBoot is an enterprise microservices framework open-sourced by Nutz. A code issue vulnerability exists in NutzBoot 2.6.0-SNAPSHOT and earlier versions, which stems from a misbehavior of the function getInputStream in the file HttpServletRpcEndpoint.java, which could lead to deserialization...