Skip to content
OpenAdvisories

Package · Packagist

oro/commerce

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • Medium 5.8
    CVE-2023-32065

    OroCommerce get-totals-for-checkout API endpoint returns unwanted data

    OroCommerce is an open-source Business to Business Commerce application built with flexibility in mind. Detailed Order totals information may be received by Order ID. This issue is patched in version 5.0.11 and 5.1.1.

    oroinc orocommerce oro/commerce Packagist
  • Medium 6.9
    CVE-2022-35950

    OroCommerce Cross-site Scripting vulnerability in add note dialog of Shopping List line item

    OroCommerce is an open-source Business to Business Commerce application. In versions 4.1.0 through 4.1.13, 4.2.0 through 4.2.10, 5.0.0 prior to 5.0.11, and 5.1.0 prior to 5.1.1, the JS payload added to the product name may be executed at the storefront when a…

    oroinc orocommerce oro/commerce Packagist
  • Medium 6.9
    CVE-2022-31037

    OroCommerce vulnerable to Cross-site Scripting via Shipping rule editing page

    OroCommerce is an open-source Business to Business Commerce application. Versions between 4.1.0 and 4.1.17 inclusive, 4.2.0 and 4.2.11 inclusive, and between 5.0.0 and 5.0.3 inclusive, are vulnerable to Cross-site Scripting in the UPS Surcharge field of the S…

    oroinc orocommerce oro/commerce Packagist
  • Medium 6.9
    GHSA-6f85-3f8q-qc94

    OroCommerce vulnerable to XSS when adding class name to Selector Manager on pages that use GrapeJS editor

    # Impact Due to insufficient class name validation in GrapeJS library it's possible to add executable JS code in class name through Selector Manager # Relates to - [https://github.com/artf/grapesjs/issues/4411](https://github.com/artf/grapesjs/issues/4411) # …

    oro/commerce Packagist