Description
A Stored Cross Site Scripting (XSS) vulnerability exists in Shopizer versions 2.0 through 2.17.0 via the “Manage Images” tab, which allows an attacker to upload a SVG file containing malicious JavaScript code.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| shopizer-ecommerce | Shopizer | 2.0 – < unspecified, unspecified – ≤ 2.17.0 | unspecified |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | com.shopizer:shopizer | >= 2.0.2, < 3.0.0 | 3.0.0 | GHSA-p2j7-6g9h-32xh |