CVE-2024-58296CWE-79cross-site-scripting

CVE-2024-58296

published December 12, 2025

CVSS
5.3
EPSS
0%
Percentile
29.5
In the wild
Unconfirmed
What it is

CE Phoenix v3.0.1 contains a stored cross-site scripting vulnerability in the currencies administration panel that allows attackers to inject malicious scripts. Attackers can insert XSS payloads in the title field to execute arbitrary JavaScript when administrators view the currencies page.

The record
Technical detail
CVSS
5.3 · NONE
CVSS v4.0
Not supplied
EPSS
0.00368 · 29.5th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-12-12T03:15Z
References (5)
https://www.exploit-db.com/exploits/52015 · [email protected]https://www.softaculous.com/apps/ecommerce/CE_Phoenix · [email protected]https://demos6.softaculous.com/CE_Phoenixx3r6jqi4kl/admin/currencies.php · [email protected]https://phoenixcart.org/ · [email protected]https://www.vulncheck.com/advisories/ce-phoenix-v-stored-cross-site-scripting-via-currencies-administration · [email protected]
EPSS history
Timeline
  • 11 DEC 21:38Z
    CE Phoenix v3.0.1 Stored Cross-Site Scripting via admin/currencies.php
    cvelistv5