WS-2021-0488

An insufficient session expiration vulnerability in “vc-platform VirtoCommerce” application version v2.1 to v3.79.0 may allow an attacker to reuse the unexpired admin user session cookie to gain admin privileges, should the attacker be able to obtain that session cookie via other, hypothetical...

WS-2021-0487

The “vc-platformVirtoCommerce” application versions v2.1 to v3.79.0 is affected by a stored XSS vulnerability via HTML file upload in the Asset Upload feature. This allows low privileged application users to store malicious scripts in the uploaded file. These scripts are executed in a victim’s...

WS-2021-0465

The “vc-platformVirtoCommerce” application versions 3.0.0-rc.1 to v3.79.0 is affected by a stored XSS vulnerability in the product description section that allows low privileged application users to store malicious scripts in the product description...