CVE-2024-38963

2024-07-0900:00:00

mitre

github.com

nopcommerce

xss

addproductreview

cross site scripting

4.70.1

cve-2024-38963

AI Score

Confidence

High

SSVC

Exploitation

poc

Automatable

Technical Impact

partial

JSON

Nopcommerce 4.70.1 is vulnerable to Cross Site Scripting (XSS) via the combined “AddProductReview.Title” and “AddProductReview.ReviewText” parameter(s) (Reviews) when creating a new review.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:nopcommerce:nopcommerce:4.70.1:*:*:*:*:*:*:*"
    ],
    "vendor": "nopcommerce",
    "product": "nopcommerce",
    "versions": [
      {
        "status": "affected",
        "version": "4.70.1"
      }
    ],
    "defaultStatus": "unknown"
  }
]