PT-2021-14197

Name of the Vulnerable Software and Affected Versions: EC-CUBE Business form output plugin versions prior to 1.0.1 Description: A cross-site scripting issue allows a remote attacker to inject an arbitrary script via an unspecified vector. This could potentially lead to unauthorized actions on the...

CVE-2021-20742: Improper Neutralization of Input During Web Page Generation

Cross-site scripting vulnerability in EC-CUBE Business form output plugin for EC-CUBE 3.0 series versions prior to version 1.0.1 allows a remote attacker to inject an arbitrary script via unspecified vector...

JVN#57524494: Multiple cross-site scripting vulnerabilities in multiple EC-CUBE plugins provided by EC-CUBE

Multiple EC-CUBE plugins provided by EC-CUBE CO.,LTD. contain multiple cross-site scripting vulnerabilities listed below. Cross-site scripting vulnerability CWE-79 - CVE-2021-20742 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L| Base Score: 7.1 CVSS v2|...