CVE-2025-22386

An issue exists in Optimizely Configured Commerce prior to version 5.2.2408 within the Commerce B2B application. The vulnerability stems from a session management flaw where session tokens associated with logged-out sessions remain active and usable in the storefront. This affects the longevity o...

CVE-2025-22387

Optimizely Configured Commerce versions prior to 5.2.2408 are vulnerable to a medium-severity issue where session tokens are submitted as URL parameters during requests for resources. This insecure practice exposes authenticated session information, which can be leveraged by an attacker to perfor...

CVE-2025-22385

The Optimizely Configured Commerce platform is vulnerable in versions prior to 5.2.2408 due to a flaw in the Commerce B2B application . The application fails to require email confirmation for newly created accounts, which allows for the mass creation of accounts . This vulnerability could lead to...

CVE-2025-22383

Optimizely Configured Commerce versions prior to 5.2.2408 are affected by a medium-severity input validation issue within the Commerce B2B application. Specifically, the Contact Us functionality allows visitors to submit email messages containing unfiltered HTML markup under certain conditions. T...

CVE-2025-22384

A business logic vulnerability exists in Optimizely Configured Commerce prior to version 5.2.2408 . The flaw is located within the Commerce B2B application , where storefront visitors can purchase discontinued products under specific scenarios if requests are altered before reaching the server. T...

CVE-2024-56173

Optimizely Configured Commerce versions prior to 5.2.2408 are vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability. The root cause is the execution of JavaScript within an SVG document , which allows malicious payloads to be stored and subsequently executed in users' browsers under spe...

CVE-2024-56175

Optimizely Configured Commerce versions prior to 5.2.2408 are vulnerable to a Stored Cross-Site Scripting (XSS) attack. The root cause is a client-side template injection occurring in list item names , which allows an attacker to store malicious payloads that execute in other users' browsers unde...

CVE-2024-56174

In Optimizely Configured Commerce versions prior to 5.2.2408 , a stored cross-site scripting (XSS) vulnerability exists due to client-side template injection in the search history. This flaw allows malicious payloads to be stored and subsequently executed within users' browsers under specific con...